The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted academic papers from user-uploaded PDF files and external URLs. This creates a surface for indirect prompt injection where malicious instructions embedded within a paper could influence the agent's behavior during the analysis phase.
Ingestion points: Files are read from /mnt/user-data/uploads/ and content is fetched from user-provided URLs in SKILL.md.
Boundary markers: The instructions do not define specific boundary markers or tags to separate paper content from system instructions.
Capability inventory: The skill uses fetch to retrieve external data and generates executable React (JSX) artifacts.
Sanitization: There are no explicit instructions to sanitize or escape the extracted paper content before it is interpolated into the React component structure.
[DYNAMIC_EXECUTION]: The skill generates a dynamic React artifact (.jsx) based on a template defined in references/notecard-template.md. While the structure is templated, the content is populated with data extracted from untrusted papers. If the source material contains malicious strings designed to escape JSX attributes or tags, it could lead to unintended script execution in the rendering environment.
[EXTERNAL_DOWNLOADS]: The skill's CSS template in references/notecard-template.md imports external fonts from Google's official font service. This is a standard and expected operation for the skill's visual styling.
[DATA_EXFILTRATION]: The skill performs network operations to fetch paper content from external URLs provided by the user. This is a core part of its intended functionality for analyzing remote research papers.

paper-onion