The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses setup_econ_review.py to create a managed Python environment and installs several reputable packages from the standard Python Package Index (PyPI), such as reportlab, pdfplumber, pypdf, and jsonschema. These downloads are expected for the skill's documented functionality.
[COMMAND_EXECUTION]: Multiple scripts, including pdf_ingestion.py, latex_pdf_renderer.py, and finalize_review.py, use subprocess.run to execute local system utilities for document processing. This includes Poppler tools (pdftotext, pdftoppm) and TeX engines (lualatex, tectonic) for generating PDF reports. The TeX renderer specifically includes a denylist to prevent unsafe TeX command execution.
[INDIRECT_PROMPT_INJECTION]: Since the skill's primary function is analyzing untrusted manuscript data (PDFs), it includes explicit security guidelines in references/red-lines.md that instruct the agent to treat all manuscript content as untrusted data and ignore any embedded directives or instructions (e.g., 'ignore prior instructions').
[DYNAMIC_EXECUTION]: The script validate_skill_package.py uses compile() as a validation step to ensure that the skill's bundled Python scripts are free of syntax errors. This is a local integrity check and does not involve executing untrusted input.

econ-review