The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documentation provides an installation command that pipes a remote shell script directly from GitHub into the bash interpreter (curl | bash). This method allows for arbitrary command execution on the host machine without the user reviewing the script's content beforehand.
[COMMAND_EXECUTION]: The literature search strategies in references/LITERATURE_SEARCH.md involve executing local shell scripts (search.sh) with JSON-formatted arguments. These scripts are responsible for handling network requests and processing academic data, presenting a risk if the inputs are not properly sanitized.
[EXTERNAL_DOWNLOADS]: The skill requires downloading external installation components and depends on real-time data fetching from third-party academic databases such as Google Scholar, PubMed, and ArXiv. This reliance on external infrastructure creates potential points of failure or data manipulation if the sources are compromised.
[PROMPT_INJECTION]: The skill is designed to process external research papers and documents. This creates a surface for indirect prompt injection attacks, where malicious instructions embedded in a retrieved paper or user-supplied reference could override the agent's instructions or safety filters.
Ingestion points: External literature search results and user-provided research summaries are loaded into the agent's context (SKILL.md, Phase 2).
Boundary markers: The skill lacks explicit boundary markers or "ignore embedded instructions" directives when processing external paper content.
Capability inventory: The skill has the capability to execute shell commands and perform network operations via the referenced search.sh scripts.
Sanitization: There is no evidence of content sanitization or validation for retrieved literature data before it is processed by the agent.

nsfc-proposal