The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill scans user-controlled directories and reads file contents (.tex, .bib) to determine project status and suggest next steps. This creates a surface where malicious instructions hidden inside those files could attempt to influence the agent's summary or the execution order of subsequent skills.
Ingestion points: The scripts/assembly_checker.py script recursively reads and parses the content of any .tex and .bib files found within the provided project directory.
Boundary markers: There are no explicit delimiters, formatting constraints, or warnings provided to the agent to treat the parsed file content as untrusted.
Capability inventory: While the assembly_checker.py script is limited to read-only operations and status reporting, the SKILL.md workflow instructs the agent to use this status report to automatically transition to and execute other high-capability skills (like experiment-code or paper-compilation).
Sanitization: The script performs regex-based extraction but lacks any sanitization or validation to filter out potential instructions embedded in the document text or metadata.

paper-assembly