The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external data (manuscript abstracts and figure captions) and interpolates this content directly into prompts for the AI agent to follow. While the instructions in SKILL.md and kernel.py correctly identify the input as untrusted, there are no structural boundary markers or sanitization logic to prevent the agent from being influenced by malicious instructions embedded in the paper data.
Ingestion points: paper_brief_prompt and narrative_review_task in kernel.py ingest raw string data from the abstract_text and figure_claims variables.
Boundary markers: Absent. The instructions merely warn the model to "re-read the whole brief," which is an insufficient guard against adversarial injection.
Capability inventory: The skill uses exec(open(...).read()) to load its logic, creating a pattern where a user might accidentally load and execute local files. While the skill itself does not perform network operations or file writes, it relies on the agent's internal capabilities to process the figures and draft the brief.
Sanitization: None detected. Input is joined and formatted directly into the prompt strings.

paper-narrative