The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, such as PDFs, arXiv/DOI links, and HTML fragments, which could contain adversarial instructions intended to influence the agent's behavior.
Ingestion points: The skill accepts a wide range of external inputs (PDF, URL, HTML, text snippets) as defined in SKILL.md.
Boundary markers: There are no explicit delimiters or boundary markers used to separate the content of the research papers from the agent's instructions, increasing the risk that the agent may follow instructions embedded within the paper text.
Capability inventory: The skill can perform file writes to the local filesystem (e.g., the papers/ and .bensz-api/ directories) and execute local scripts.
Sanitization: Mitigation strategies include specific instructions for the agent to distinguish between 'original facts' and 'author claims,' as well as the use of a linting script (validate_notes.py) to enforce formatting and evidence consistency.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands and local Python scripts provided within the skill package.
Evidence: SKILL.md and README.md specify the execution of python3 scripts/validate_notes.py for style and mechanical validation.
Evidence: SKILL.md allows the agent to use the GitHub CLI (gh api) to upload desensitized bug reports if explicitly requested by the user.
[DATA_EXFILTRATION]: The skill includes a feature that can transmit data to a remote service.
Evidence: The bug reporting mechanism uses gh api to send data to GitHub. While GitHub is a well-known service and the action is gated by user request, it establishes a network path for transferring local data.

research-literature-interpretation