The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains a command to download and execute a shell script from an external, non-whitelisted domain (https://parallel.ai/install.sh) by piping it directly into bash. This pattern is a significant security risk as it executes remote code with the current user's privileges without verification or integrity checks.
[EXTERNAL_DOWNLOADS]: The skill depends on external tools and scripts from parallel.ai, which is not a recognized trusted organization or well-known service according to the security framework. This introduces a supply chain risk.
[COMMAND_EXECUTION]: The Python scripts scripts/generate_pdf.py and scripts/generate_schematic.py utilize subprocess.run() to invoke system-level tools such as pandoc, xelatex, and other Python scripts. While functional, these calls execute shell commands that could be exploited if malicious inputs were to reach them.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external literature databases and user-supplied diagram descriptions.
Ingestion points: Data enters the system via combined_results.json (aggregated search results) and the prompt argument in scripts/generate_schematic_ai.py.
Boundary markers: Absent; the instructions passed to the LLM for schematic generation do not include delimiters or specific instructions to disregard potentially malicious commands embedded in the research abstracts or user descriptions.
Capability inventory: The skill has the capability to execute shell commands (via subprocess.run for PDF generation) and make network requests (via requests to OpenRouter).
Sanitization: There is no evidence of filtering, escaping, or validation of external content before it is interpolated into LLM prompts in scripts/generate_schematic_ai.py.

literature-review