The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script kernel.py executes the shell command git config user.email using subprocess.run to retrieve the user's identity from their local environment.\n- [DATA_EXFILTRATION]: The user's email address, collected from environment variables or via local command execution, is transmitted to external servers (api.crossref.org and doi.org) as part of the User-Agent HTTP header.\n- [DYNAMIC_EXECUTION]: The skill's setup instructions in SKILL.md direct the agent to execute the Python helper script at runtime using exec(open(...).read()), which dynamically loads local code into the agent's environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill represents an indirect injection surface by ingesting untrusted scholarly metadata from OpenAlex and Crossref APIs into the agent's context. Evidence chain: 1) Ingestion points: search_openalex and crossref_lookup in kernel.py. 2) Boundary markers: Absent. 3) Capability inventory: Network access (urllib.request) and shell execution (subprocess.run). 4) Sanitization: The skill includes a deterministic style_pass function to mitigate risks by avoiding LLM-based corrections of retrieved text.

literature-review