The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from external sources, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill instructs the agent to extract claims from research papers and map them to code in external repositories (Step 1 and Step 2 in SKILL.md).
Boundary markers: There are no instructions to use delimiters or ignore potentially malicious content embedded in the research papers or codebases.
Capability inventory: The agent is encouraged to perform shell operations including pip install, python train.py, and python eval.py (Step 4 in SKILL.md).
Sanitization: No sanitization, validation, or isolation mechanisms are mentioned to protect the environment from hostile code within the audited repositories.
[COMMAND_EXECUTION]: The reproducibility check protocol explicitly details shell commands for the agent to run, such as environment setup via pip and model execution via python. This execution of untrusted code is the intended purpose but remains a significant attack surface.
[EXTERNAL_DOWNLOADS]: The workflow relies on fetching data from remote sources like GitHub and arXiv. While these are common for research, the skill encourages interacting with any repository link provided for a paper audit, which may be untrusted.

paper-audit