The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator assembles and executes shell commands using eval based on data parsed from sub-agent responses.
Evidence: The line eval bash <skills-root>/_shared/review-state-log.sh "$ARGS" ... in SKILL.md executes a shell script with arguments derived from a sub-agent's return.
Risk: The $ARGS variable is populated by parsing a sub-agent's response using parse-stamp-directive.sh. Since sub-agents process untrusted external documents (research papers), a sophisticated attacker could embed instructions within a LaTeX or BibTeX file that manipulate a sub-agent's output. This could inject malicious shell arguments into $ARGS, leading to arbitrary command execution when the string is evaluated by the orchestrator shell.
[INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by processing untrusted paper artifacts and passing them to 13 autonomous sub-agents.
Ingestion points: SKILL.md identifies .tex, .bib, and .log files as input sources for the review process.
Boundary markers: The skill does not define strict delimiters or instructions to sub-agents to ignore potentially malicious commands embedded in the document text.
Capability inventory: The orchestrator possesses broad capabilities including shell command execution (latexmk, mkdir, uv), file system access, and the ability to dispatch multiple agents with varying capabilities.
Sanitization: While the skill implements a spot-verification step to confirm that findings are grounded in the text, it lacks sanitization of the extracted data before it is used to populate variables for further shell execution.

pre-submission-report