The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from .tex and .bib files, extracting sentences and reference metadata for semantic evaluation by the AI. An attacker-controlled document could contain malicious instructions designed to manipulate the audit results or the agent's behavior.
Ingestion points: LaTeX source files and BibTeX databases processed in scripts/latex_scanner.py and scripts/bib_utils.py.
Boundary markers: The skill uses a structured JSON intermediate format (ai_ref_alignment_input.json) to pass data to the AI, which provides better separation than raw text interpolation.
Capability inventory: The skill performs shell command execution for extraction, makes network requests to academic APIs, and writes markdown reports to the filesystem.
Sanitization: Extracted sentences are truncated to a maximum length (default 500 characters) in scripts/latex_scanner.py before being sent to the AI context.
[DATA_EXFILTRATION]: While the skill primarily communicates with well-known academic services (Crossref and OpenAlex) to verify DOIs, the logic for discovering bibliography files in scripts/latex_scanner.py lacks sufficient path validation. Unlike the dependency tree logic for LaTeX files which restricts paths to the project root, the discover_bib_files function allows absolute paths in \bibliography{} or \addbibresource{} commands. This could potentially be used to read arbitrary files on the host system if a document is crafted to point to sensitive locations, though the BibTeX parser would likely fail to find valid bibliography entries in non-bib files.

nsfc-ref-alignment