The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided content (PDF files and LaTeX logs) and provides this data to a vision model for layout analysis. An attacker could potentially embed instructions within a document's text or layout that influence the vision model's verdict or the agent's final report.
Ingestion points: Processes .pdf files (rendered to images) and out/main.log files.
Boundary markers: The vision prompts in references/vision-prompts.md do not include explicit delimiters or instructions for the model to ignore potential commands embedded in the visual content.
Capability inventory: The skill has access to Bash for command execution, Write for generating reports, and Edit for modifying source files.
Sanitization: No sanitization or filtering is applied to the rendered images or log content before processing.
[COMMAND_EXECUTION]: The skill executes shell commands using arguments derived from local project files, which is a common vulnerability surface.
Evidence: In Phase 3, page numbers are extracted from out/main.log using awk and then iterated over in a shell loop to execute pdftoppm. While the extraction logic is constrained to digits, it still represents a dependency on untrusted file content for shell command construction.

latex-polish