The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process the full text of external academic papers, which creates a surface for indirect prompt injection if a paper contains malicious instructions designed to influence the agent's behavior.
Ingestion points: arXiv PDF and HTML content (via curl and pymupdf) in SKILL.md working workflow.
Boundary markers: The instructions lack specific delimiters or instructions for the agent to ignore potentially adversarial content within the ingested papers.
Capability inventory: Shell command execution (curl, mkdir), and extensive file write permissions within the path specified by $OBSIDIAN_VAULT.
Sanitization: There is no mention of sanitizing or filtering the content extracted from the PDFs before it is used to generate notes or perform other operations.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (curl, mkdir) using variables (ARXIV_ID) derived from external user-supplied URLs. If the agent fails to properly sanitize the extracted ID, it could lead to command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches PDF documents and images from arxiv.org. While arXiv is a well-known academic service, the skill downloads this external content directly into the user's Obsidian vault environment.
[PROMPT_INJECTION]: The skill contains a specific instruction to "prohibit the use of /tmp or other temporary directories to avoid triggering permission confirmation." This is a bypass pattern intended to circumvent platform security controls or user oversight regarding file system operations.

read-arxiv-paper