The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documentation instructs users to install the parallel-cli tool using a highly insecure method: piping a remote script directly to the bash shell.
Evidence: SKILL.md contains the command curl -fsSL https://parallel.ai/install.sh | bash in the Required CLI Tools section. This executes unverified remote code with the privileges of the current user.
[COMMAND_EXECUTION]: Several scripts within the skill utilize the subprocess module to execute system-level commands, which increases the potential impact of other vulnerabilities.
Evidence: scripts/generate_pdf.py uses subprocess.run to invoke the pandoc and xelatex binaries.
Evidence: scripts/generate_schematic.py uses subprocess.run to execute a child Python process (generate_schematic_ai.py).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection because it processes untrusted external content (literature abstracts and full texts) while having shell execution capabilities.
Ingestion points: Untrusted data enters the agent context through parallel-cli search outputs, parallel-cli extract full-text results, and citation metadata retrieved from the CrossRef API in scripts/verify_citations.py.
Boundary markers: None identified. The instructions do not define clear delimiters or provide instructions to the agent to disregard embedded directives within the literature being reviewed.
Capability inventory: The skill is granted the Bash tool and contains scripts that execute shell commands using subprocess.run (e.g., scripts/generate_pdf.py).
Sanitization: None identified. Data aggregated by scripts/search_databases.py is not sanitized for malicious prompt patterns before being processed for thematic synthesis.

literature-review