The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted LaTeX source files and build logs provided by the user, which could contain embedded instructions intended to influence the agent's behavior during the review process.
Ingestion points: The script scripts/check_tex.py (referenced in SKILL.md) reads the content of a root LaTeX file and recursively follows \input and \include statements to read all associated files in the project directory. It also optionally reads a build log file.
Boundary markers: No specific delimiters or warnings are used to isolate the ingested LaTeX content from the agent's instructions.
Capability inventory: The skill allows the agent to read local files and execute a bundled Python script. It does not have permissions for network exfiltration, writing to the file system, or escalating privileges.
Sanitization: The tool uses regular expressions to identify specific text patterns (like TODOs or doubled words) and does not perform sanitization or validation to filter out potential prompt injection attacks within the document source.
[COMMAND_EXECUTION]: The skill instructs the agent to run a bundled Python script to perform automated paper checks.
Evidence: SKILL.md provides shell commands such as python3 scripts/check_tex.py path/to/main.tex. Analysis of the script scripts/check_tex.py indicates it relies solely on Python's standard library and performs read-only operations on the provided file paths without spawning additional processes or executing shell commands.

credo-release