The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to run multiple Python scripts (search_arxiv.py, scan_existing_notes.py, link_keywords.py) located at server/scripts/research-news/. The skill manifest (SKILL.md frontmatter) explicitly states scriptCount: 0 and hasScripts: false, indicating these scripts are external dependencies not contained within the skill's own directory, which increases the risk of executing unverified or malicious local code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from research APIs, creating an attack surface for indirect prompt injection.
Ingestion points: Data is fetched from arXiv and Semantic Scholar APIs (titles, abstracts, metadata).
Boundary markers: None are defined to separate external data from internal reasoning.
Capability inventory: The agent has access to shell execution (Python scripts) and file system writes (write_file).
Sanitization: No sanitization or validation of the fetched paper metadata is described before it is processed or used in recommendation lists.
[METADATA_POISONING]: The skill uses suspicious naming conventions in its documentation, including attribution to a repository named evil-read-arxiv and a persona reference to 'Dr. Claw' (a fictional villain). While potentially stylistic, these indicators warrant caution regarding the original intent of the logic.

research-news