The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on and executes a local CLI tool named scholar, which is expected to be present in the user's home directory (~/projects/google-scholar-cli/scholar). This tool is used for all core functionality including searching, fetching citations, and downloading files.
[CREDENTIALS_UNSAFE]: The skill manages authentication by accessing a sensitive file path at ~/.google-scholar/cookies. It utilizes a specialized command (scholar auth) to extract session cookies from a browser using remote debugging on port 9222.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content fetched from Google Scholar, such as paper abstracts and BibTeX metadata, which could be used as an attack vector.
Ingestion points: Search results, snippets, and BibTeX entries retrieved via the scholar CLI tool are ingested into the agent context (SKILL.md).
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the external data it processes.
Capability inventory: The skill has the ability to execute shell commands (scholar), perform network operations, and write files to the disk (--download flag).
Sanitization: There is no evidence of sanitization or filtering applied to the retrieved paper metadata or abstracts before they are presented to the agent.

google-scholar