The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file includes a shell command within the dynamic context syntax (!...) that executes at skill load time. This command attempts to locate and run skill-toc to generate a table of contents for the skill's reference materials.
[DYNAMIC_EXECUTION]: The scripts/bibman.py script dynamically loads a local dependency, pincite.py, using importlib.util.spec_from_file_location. This allows the skill to execute code from a sibling project at runtime.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute the local paperpile CLI tool, passing user-derived search queries to retrieve bibliographic data in JSON format.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crossref.org and www.govinfo.gov to retrieve bibliographic metadata and Federal Register PDF documents.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted bibliographic data and PDF filenames which are interpolated into search queries and metadata fields.
- Ingestion points: Bibliographic entries in .bib files and filenames within the project's PDF directory.
- Boundary markers: None are present to distinguish between trusted instructions and external data in the processed fields.
- Capability inventory: The skill possesses network access (urllib), shell execution capabilities (subprocess), and the ability to overwrite local bibliography files.
- Sanitization: The script uses regular expressions and similarity matching to validate data, but does not perform comprehensive sanitization or escaping of the metadata before using it in API queries.

bib-manage