The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions directly interpolate the $ARGUMENTS variable into the system prompt. A malicious user could provide a research request designed to override the coordinator's instructions, potentially causing it to ignore safety guidelines or perform unauthorized actions.
[INDIRECT_PROMPT_INJECTION]: The subagents managed by this skill process untrusted data from external sources via the paper-search browse <url> tool, creating a surface for indirect injection attacks.
Ingestion points: User-provided research requests ($ARGUMENTS) and content fetched from the public web/academic databases through CLI search tools.
Boundary markers: The skill lacks explicit delimiters or instructions for the agent to disregard commands embedded within the external research data it processes.
Capability inventory: The orchestrator and its spawned subagents have access to Bash (command execution), Task (agent spawning), and Write/Read (filesystem access).
Sanitization: The skill does not implement validation or sanitization of the content retrieved from external URLs before processing it.
[COMMAND_EXECUTION]: The skill leverages the Bash tool to interact with research CLI utilities (paper, paper-search). While these tools are necessary for the skill's functionality, the availability of a full shell environment increases the impact of a potential prompt injection compromise.

research-coordinator