The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where malicious instructions embedded in academic paper metadata (titles, abstracts) could influence the agent's behavior during the synthesis phase. External data is ingested and processed without sanitization or explicit instruction boundaries.
Ingestion points: Untrusted data enters the agent context through scripts/search_databases.py (which processes JSON result files) and scripts/verify_citations.py (which fetches metadata from the CrossRef API).
Boundary markers: Absent. The skill provides a structured template in assets/review_template.md but lacks delimiters or instructions for the agent to disregard potentially malicious content within the analyzed literature.
Capability inventory: The skill has access to the Bash, Write, and Edit tools. Additionally, scripts/generate_pdf.py utilizes subprocess.run to execute system commands.
Sanitization: Absent. No escaping or validation is performed on the text content retrieved from external databases before it is interpolated into the literature review prompt or final document.
[COMMAND_EXECUTION]: The scripts/generate_pdf.py script executes the pandoc command-line utility via subprocess.run to handle the conversion of Markdown documents to PDF format. This is a standard functional component but represents a site of local command execution.
[EXTERNAL_DOWNLOADS]: The scripts/verify_citations.py script performs network operations using the requests library to connect to doi.org and api.crossref.org. These are well-known academic infrastructure services used to verify publication metadata.
[DYNAMIC_EXECUTION]: The skill uses subprocess.run in scripts/generate_pdf.py to invoke the pandoc and xelatex binaries at runtime. While the command arguments are structured as a list to prevent shell injection, it constitutes the execution of system processes based on skill-generated parameters.

literature-review