The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from academic papers, including titles, abstracts, and full text retrieved from arXiv or a local Zotero database. Malicious instructions embedded in a paper's text or metadata could potentially override agent behavior during the analysis phase.
Ingestion points: Paper titles and metadata are read from the Zotero SQLite database in paper_daemon.py and assets/zotero_helper.py. Full-text HTML/PDF content is fetched from arXiv.
Boundary markers: The skill uses Markdown headers and templates to structure the agent's output, but lacks explicit boundary markers to isolate untrusted paper content from instructions.
Capability inventory: The agent has capabilities to read and write files, search and fetch web content, and execute local commands via subprocess.run (invoking the claude CLI).
Sanitization: Paper titles and content are interpolated into the prompt without sanitization to prevent instruction leakage.
[COMMAND_EXECUTION]: The script paper_daemon.py programmatically invokes the claude CLI tool using subprocess.run. It passes a generated prompt containing untrusted paper metadata as an argument. The command uses the --dangerously-skip-permissions flag, which reduces user oversight for automated actions.
[EXTERNAL_DOWNLOADS]: The skill fetches PDF and HTML content from arxiv.org. This is a well-known academic repository, and the download behavior is consistent with the skill's stated purpose.

paper-reader