The Agent Skills Directory

[PROMPT_INJECTION]: The instructions contain a sophisticated attempt to override agent safety guidelines. It explicitly directs the orchestrator to disregard "tool-surface uncertainty" and claims the agent "always has Bash," effectively encouraging the bypass of the restricted allowed-tools list (which only permits specific Bash patterns like uv* and ls*).- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a dangerous vulnerability surface by processing untrusted LaTeX documents through multiple sub-agents.
Ingestion points: Processes all .tex files found in the paper-*/ directory (SKILL.md, Phase 1).
Boundary markers: While it mentions an integrity rule requiring verbatim quotes, it lacks delimiters to prevent the sub-agents from interpreting malicious text in the paper as instructions.
Capability inventory: The orchestrator has access to shell commands and uses eval to process outputs.
Sanitization: There is no evidence of sanitization or validation of the data returned by sub-agents before it is used in command construction.- [COMMAND_EXECUTION]: The skill implements a highly unsafe command execution pattern in the 'REVIEW-STATE.md propagation' section. It captures variables from sub-agent responses and passes them directly to eval bash, allowing any malicious instruction embedded in a sub-agent's response (potentially triggered by a malicious LaTeX file) to be executed with the agent's full permissions.- [DYNAMIC_EXECUTION]: The orchestrator is programmed to execute a sequence of local bash scripts (parse-stamp-directive.sh, post-dispatch-verify.sh, and review-state-log.sh) from a specific <skills-root>/_shared/ directory. This assumes an execution environment where the agent has broader filesystem and execution rights than standard security policies allow.

review-cluster