The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_schematic.py uses subprocess.run to execute a local helper script scripts/generate_schematic_ai.py. This call is implemented using a list of arguments rather than a shell string, which is the recommended practice for preventing shell injection. It is used exclusively to facilitate iterative diagram generation as described in the skill's workflow.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to reputable academic APIs (CrossRef, PubMed E-utilities, arXiv) and the OpenRouter AI service to perform literature searches, fetch metadata, and generate schematics. These connections are transparent, documented, and essential for the tool's intended academic purpose.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted academic data such as paper titles and abstracts retrieved from the web. While this presents a potential surface for indirect prompt injection, the scripts utilize structured XML and JSON parsers and avoid using untrusted input in sensitive functions like eval() or exec(). The inherent risk is low and well-managed.

citation-management