The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill contains instructions to load and execute a Python script from a local directory using the exec(open(...).read()) pattern. This method of dynamic loading is used to share functionality across different skills but represents a sensitive execution vector if the path or file content were manipulated.
Evidence (references/figures-and-tables.md): exec(open("<skills>/figure-style/kernel.py").read()) followed by apply_figure_style().
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process user-provided content (outlines, technical ideas, and drafts) to generate English prose. This creates an attack surface for indirect prompt injection where instructions embedded in the user's research data could influence the agent's behavior.
Ingestion points: User-provided writing ideas, paper outlines, and draft text processed in SKILL.md and referenced templates.
Boundary markers: The templates do not define explicit delimiters or warnings to ignore instructions embedded within the user-provided research content.
Capability inventory: The skill calls other tools and skills (e.g., figure-style, figure-composer) to process data and generate outputs.
Sanitization: No explicit sanitization or filtering mechanisms for external user data are documented.

paper-writing