The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to perform string replacement of a placeholder (PMID_HERE) with user-supplied input ($ARGUMENTS) inside a JavaScript block. This pattern is vulnerable to code injection; a malicious user or indirect source could provide a specially crafted string to escape the variable context and execute arbitrary JavaScript within the browser tool.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and displays external content (paper abstracts, titles, and metadata) from the PubMed database without using boundary markers or sanitization. This creates a surface for indirect prompt injection where instructions hidden within scientific text could influence the agent's behavior.
Ingestion points: XML data fetched from the official NCBI E-utilities API (eutils.ncbi.nlm.nih.gov).
Boundary markers: Absent; the content is interpolated directly into the final Markdown response.
Capability inventory: The skill utilizes mcp__chrome-devtools__navigate_page and evaluate_script, providing a significant capability surface if the agent follows malicious instructions from the fetched data.
Sanitization: While the script uses textContent to extract data from XML, the resulting strings are not sanitized or escaped before being presented to the agent or the user.
[COMMAND_EXECUTION]: The skill relies on the evaluate_script tool to execute dynamically generated JavaScript. The lack of validation for the PMID argument before it is used to construct URLs and scripts allows for potential manipulation of the tool's execution flow.

pm-paper-detail