The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes a dedicated script scripts/download_accessible_fulltexts.py that fetches scholarly articles from the internet. It explicitly validates that URLs start with http:// or https:// before fetching, preventing local file access via URL manipulation. It also implements delays and uses a descriptive User-Agent to respect the target servers.
[COMMAND_EXECUTION]: The script scripts/generate_readable_report.py utilizes subprocess.run to invoke system browsers (Edge, Chrome, or Chromium) in headless mode. This is used solely to render HTML download reports into PDF format. The command is constructed as a list of arguments rather than a shell string, which effectively mitigates common command injection risks.
[DATA_EXFILTRATION]: Analysis of the network-capable scripts shows that data flow is limited to fetching literature and accessing public scholarly search APIs. No evidence of unauthorized harvesting of environment variables, local files, or credentials was found.
[PROMPT_INJECTION]: The SKILL.md and README.md files provide clear operational guidelines that align with legal and ethical standards for academic research. There are no attempts to override agent safety protocols or hijack the system prompt.

literature-downloader