The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses scripts/fetch_pdfs.py to download academic papers. The primary sources are api.openalex.org and api.unpaywall.org, which are well-known and trusted academic data providers. It also references api.crossref.org for DOI verification in scripts/verify_refs.py. These operations follow the primary purpose of a literature research skill and target reputable services.
[COMMAND_EXECUTION]: The script scripts/render_report.py executes system browsers (Edge, Chrome, or Chromium) in headless mode via subprocess.run to convert HTML reports to PDF. The command arguments are constructed from file paths and the browser executable path. While it uses shell=False (default), it does interact with the local environment to find and run installed browsers.
[DYNAMIC_EXECUTION]: The skill includes several Python scripts that are intended to be executed by the agent to perform specific tasks like scoring papers, extracting PDF content, and verifying references. These are local scripts provided within the skill package and do not involve executing dynamically generated or untrusted code.
[INDIRECT_PROMPT_INJECTION]: As a literature survey tool, the skill processes untrusted external data (PDFs and abstracts from the web). The extract_pdfs.py script converts PDFs to Markdown to provide a cleaner context for the agent, which can inadvertently carry injection attempts hidden in academic text. The skill mitigates this by using specific structured templates (e.g., references/angle-report.md, references/paper-card.md) and enforcing a 'source-map-first' principle that requires the agent to cite specific page numbers and sections, reducing the risk of the model following instructions embedded in the papers.

shidi