The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided LaTeX (.tex) and BibTeX (.bib) files, as well as info_form.md. These ingestion points (in scripts/core/hybrid_coordinator.py and scripts/run.py) lead to content being interpolated into prompts for the host AI. While the skill possesses significant capabilities (file writes, network requests, and CLI command execution), it lacks explicit boundary markers or sanitization to prevent embedded instructions in these project files from influencing agent behavior. This vulnerability surface is classified as low severity.
[COMMAND_EXECUTION]: The skill uses the subprocess module to execute internal self-tests using pytest and for configuration validation. It also references the use of the gh (GitHub CLI) for reporting bugs to the author's repository. These operations are either scoped to the skill's own directory or require explicit user authorization for external reporting.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crossref.org to verify Digital Object Identifiers (DOI). Crossref is a well-known service in the scientific community, and this functionality is used solely for metadata validation.
[DATA_EXFILTRATION]: The skill contains logic to report bugs to a specific repository (huangwb8/bensz-bugs) belonging to the author using the gh CLI. This feature is intended for troubleshooting and is only triggered by explicit user request.

nsfc-justification-writer