The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator is instructed to execute shell commands via a user-defined <render_cmd> (typically python3) and a literature search tool (lit_search.py). This allows the agent to run arbitrary code on the host system.
[REMOTE_CODE_EXECUTION]: The skill follows a 'Script generation + execution' pattern. The generator role authors a Python script (plot.py) which is subsequently executed within the user's environment to render figures. This poses a significant risk if the generated code is influenced by malicious input.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It ingests untrusted data from the user's <brief> and data files (<data_paths>) without explicit boundary markers or sanitization. An attacker could embed instructions within these inputs to manipulate the generator agent into writing malicious code or exfiltrating data.
Ingestion points: <brief> (markdown/prose) and <data_paths> (CSV, TSV, Parquet, JSON) as defined in SKILL.md.
Boundary markers: None identified; untrusted data is processed directly by the agents.
Capability inventory: Subprocess execution of generated Python scripts and shell-based literature tools as defined in roles/generator.md.
Sanitization: None identified; the agent relies on the 'generator' role's ability to interpret data correctly.
[EXTERNAL_DOWNLOADS]: The skill fetches external content, including journal figure guidelines via WebSearch/WebFetch and scientific literature via Semantic Scholar and arXiv. While these are reputable sources, the ingestion of this external data adds to the indirect prompt injection surface.

scientific-figure