The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is explicitly designed to identify and execute a <plot_command> from the user's environment or project configuration files. This command is run in the shell to regenerate figures during the revision loop.
[REMOTE_CODE_EXECUTION]: The execution of the <plot_command> typically involves running scripts provided within the repository (e.g., python3 ./src/plots.py). If the repository is malicious, this allows for arbitrary code execution on the agent's host machine.
[PROMPT_INJECTION]: The skill processes untrusted external data in the form of scientific drafts and datasets. This presents a high surface for indirect prompt injection, where malicious instructions embedded in the draft could influence the behavior of the subagents (judges and writer).
Ingestion points: Scientific drafts (draft_path) and dataset files (dataset_paths).
Boundary markers: No explicit delimiters are used to separate untrusted draft content from the agent's instructions.
Capability inventory: File system access (read/write in sandbox), network access (via literature tool), and shell command execution.
Sanitization: No evidence of sanitization or filtering of the draft content before it is processed by the agent roles.
[EXTERNAL_DOWNLOADS]: The skill utilizes a literature-search tool and fallbacks like WebSearch to fetch data from external academic repositories (Semantic Scholar and arXiv). While these sources are generally trusted, the combination of network access and the execution of project-provided code creates a potential path for data exfiltration.
[CREDENTIALS_UNSAFE]: While the skill correctly advises users to use a keys.env file and avoid pasting secrets into chat, the system's ability to execute arbitrary code means it could potentially be used to harvest these keys if the plot_command or associated scripts are compromised.

scientific-writer