The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to accept natural language descriptions from the user for schematic generation and interpolates them directly into a shell command: python scripts/generate_schematic.py "{description}". The absence of boundary markers or sanitization logic allows for a potential command injection surface where shell metacharacters could be used to execute unauthorized commands.
Ingestion points: User-provided diagram descriptions referenced in SKILL.md.
Boundary markers: None provided in the instructions.
Capability inventory: Bash tool usage for executing external scripts.
Sanitization: No evidence of input escaping or validation.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute various Python scripts for specialized tasks like compliance checking and budget calculation.
Evidence: SKILL.md lists Bash in the allowed-tools and provides command examples like python scripts/generate_schematic.py.
[METADATA_POISONING]: There is a discrepancy between the reported author (leonchaox) and the author declared in the skill's YAML frontmatter (K-Dense Inc.). This inconsistency in attribution can lead to confusion regarding the source and trustworthiness of the skill.
Evidence: SKILL.md YAML frontmatter includes skill-author: K-Dense Inc..
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install external research templates and packages from public GitHub repositories, such as the nstc-proposal LaTeX package.
Evidence: references/nstc_guidelines.md suggests using git clone https://github.com/L-TChen/nstc-proposal.git.
[DYNAMIC_EXECUTION]: The skill references several Python scripts (scripts/generate_schematic.py, scripts/compliance_checker.py, scripts/budget_calculator.py, and scripts/deadline_tracker.py) intended for runtime execution that were not included in the provided file package.
Evidence: SKILL.md references these scripts in the 'How to generate schematics' and 'Scripts and Tools' sections.

research-grants