The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of NSFC grant proposal documents, including .tex, .md, and .txt files. This creates a surface for indirect prompt injection if the proposal text contains malicious instructions aimed at the agent. While SKILL.md contains an explicit instruction to treat this content as text to be analyzed and to ignore any embedded commands, the surface remains.
Ingestion points: The scripts/nsfc_code_rank.py script reads text files from user-specified directories.
Boundary markers: SKILL.md instructs the agent to treat input as 'text to be analyzed' and ignore embedded instructions.
Capability inventory: The skill executes shell commands (mkdir, cp, python3) and writes files to the local workspace.
Sanitization: The ranking script uses a latex_to_text function to strip common LaTeX commands and whitespace, but this is a heuristic cleanup rather than a security-hardened sanitization.
[COMMAND_EXECUTION]: The skill instructions direct the agent to perform local environment setup and file operations. This includes using mkdir to create task-specific directories in a hidden .bensz-api folder, using python3 to execute the skill's own analysis scripts, and using cp to deliver the final report. These actions are limited to the skill's defined workflow and the local filesystem.
[SAFE]: The skill mentions a bug reporting mechanism that involves the GitHub CLI (gh) to upload reports to the author's repository (huangwb8/bensz-bugs). This action is documented as being triggered only upon explicit user request. Since GitHub is a well-known service for development tasks, this integration is standard and considered safe.

nsfc-code