The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script (lit_search.py) from a sibling skill directory to perform paper searches and manage configuration. This is a standard and intended use of local tooling for the defined purpose.
[EXTERNAL_DOWNLOADS]: The agent retrieves research data from Semantic Scholar and arXiv, which are well-known and reputable academic services. It also supports general web searches as a fallback for literature retrieval.
[DATA_EXFILTRATION]: The skill manages an optional API key for literature services. It follows safe management practices by requiring the key to be stored in an external, gitignored file (keys.env) and explicitly instructs the agent not to reveal it in chat sessions.
[PROMPT_INJECTION]: The skill processes verbatim snippets from external papers which are then evaluated by a multi-agent pipeline. This creates an attack surface for indirect prompt injection if an external source contains malicious instructions intended to manipulate the agent's logic or scoring.
Ingestion points: Snippets from papers fetched via S2, arXiv, and WebFetch, stored in round/litscout.json as described in roles/LiteratureScout.md.
Boundary markers: The skill uses structured JSON for data exchange but lacks specific instructions or delimiters to ignore or sanitize embedded instructions within the text snippets.
Capability inventory: The agent can execute scripts, spawn subagents, and perform filesystem operations in the designated sandbox directory.
Sanitization: There is no evidence of filtering or sanitizing the retrieved paper content before it is processed by the orchestration loop.

hypothesis-gen