The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes instructions for the AI agent to execute local scripts such as scripts/generate_schematic.py, scripts/compliance_checker.py, scripts/budget_calculator.py, and scripts/deadline_tracker.py using the Bash tool to automate administrative and illustrative tasks.
[INDIRECT_PROMPT_INJECTION]: The instruction set provides a command template (python scripts/generate_schematic.py "your diagram description") that interpolates user-provided natural language directly into a shell execution context. This creates an attack surface for command injection if a user or an external data source provides a description containing shell metacharacters (e.g., backticks or semicolons).
Ingestion points: User-supplied research descriptions and diagram requests processed in SKILL.md.
Boundary markers: The instructions lack specific delimiters or warnings to the agent to sanitize or escape characters in the interpolated strings.
Capability inventory: The skill is granted Bash execution, Read, Write, and Edit tool permissions in the frontmatter.
Sanitization: No sanitization or input validation logic is prescribed for the transition from the user's natural language request to the bash command argument.

research-grants