The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell scripts using bash. Specifically, it runs scripts/codex-research.sh (or a version located in ~/.claude/scripts/) and the pandoc utility for document conversion. While these are part of the stated functionality, executing local scripts based on user-supplied queries introduces risk.
[CREDENTIALS_UNSAFE]: The skill attempts to access and execute scripts from a sensitive directory: ~/.claude/scripts/. This path is within the user's home directory and could potentially contain sensitive configuration or credentials.
[EXTERNAL_DOWNLOADS]: The skill fetches data from several external platforms, including Exa, arXiv, and Google Scholar. These are well-known academic and technical services used for source harvesting.
[PROMPT_INJECTION]: The skill has a high exposure to indirect prompt injection (Category 8). It is designed to process between 80 and 120 external sources, including web pages and academic papers, and feed their content into multiple sub-agents (Researcher A, Researcher B, Critic, Editor).
Ingestion points: mcp__exa__web_search_advanced_exa, arxiv.org, scholar.google.com, and general web scraping via Tavily or Firecrawl.
Boundary markers: Absent. The prompts for sub-agents do not include delimiters or instructions to ignore embedded commands within the scraped text.
Capability inventory: The skill can execute shell commands (bash), create new agents, and perform extensive file system operations (read/write) in the .firecrawl/research/ directory.
Sanitization: No evidence of sanitization or filtering for the external content before it is processed by the LLM agents.

academic-research