The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it directly interpolates untrusted data from training and test datasets into LLM prompts using variables like ${text_features_1}, ${sample_text}, and ${observations}.
Ingestion points: Data is ingested from JSON files specified in the config.yaml (e.g., train_data_path, test_data_path) as described in SKILL.md and references/config_template.yaml.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the prompt templates in references/config_template.yaml.
Capability inventory: The skill enables the execution of shell commands via CLI tools (hypogenic_generation, hypogenic_inference) and setup scripts (setup_grobid.sh), creating a path for malicious instructions in datasets to influence agent actions.
Sanitization: No sanitization or escaping of dataset content is mentioned or implemented in the provided configuration files.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to download datasets and example code from public GitHub repositories (github.com/ChicagoHAI/HypoGeniC-datasets.git and github.com/ChicagoHAI/Hypothesis-agent-datasets.git).
[COMMAND_EXECUTION]: The skill involves the execution of multiple shell commands for installation and operation, including uv pip install, git clone, and bash execution for infrastructure setup (e.g., setup_grobid.sh, run_grobid.sh). These commands are consistent with the skill's stated purpose as a CLI research tool.

hypogenic