The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves ingesting and processing untrusted external content (academic papers) through scripts/extract_pdf.py and WebFetch. An attacker could embed malicious instructions within a paper to influence the agent's behavior.
Ingestion points: Full-text extraction from PDFs and HTML papers, as well as metadata from search APIs.
Boundary markers: No explicit markers or instructions are provided to the agent to treat external paper content as untrusted data.
Capability inventory: The skill uses Bash to execute local scripts, has network access via urllib and WebFetch, and can write files using the Write tool.
Sanitization: No content sanitization is performed on the extracted paper text before it is presented to the agent for synthesis.
[EXTERNAL_DOWNLOADS]: The skill downloads PDF files from URLs provided by academic search APIs via scripts/download_papers.py. While targeting well-known academic services, the content itself is untrusted.
Evidence: scripts/download_papers.py fetches PDFs from pdf_url fields in the paper_db.jsonl database.
[COMMAND_EXECUTION]: The workflow relies on executing multiple Python scripts from the shell to manage the research phases. While these scripts are part of the skill, the pattern of shell execution increases the attack surface.
Evidence: SKILL.md instructions frequently use python /path/to/script.py with various arguments.

deep-research