The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/generate_pdf.py executes system commands for pandoc and xelatex. Evidence: subprocess calls in scripts/generate_pdf.py (lines 53 and 106) use lists for command arguments, avoiding shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill fetches data from reputable scientific services. Evidence: scripts/verify_citations.py (lines 35 and 52) makes HTTP requests to doi.org and api.crossref.org.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to processing external research data. Ingestion points: Bibliographic metadata from api.crossref.org and search result JSONs. Boundary markers: None identified in instructions or scripts. Capability inventory: Subprocess execution in scripts/generate_pdf.py and broad file system permissions (Bash/Read/Write). Sanitization: No filtering is applied to retrieved titles or abstracts to prevent adversarial instructions.\n- [SAFE]: The skill's behavior matches its stated academic purpose. It uses standard libraries and tools, follows recognized research methodologies (PRISMA/PICO), and lacks indicators of obfuscation, persistence, or data exfiltration.

literature-review