The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents a significant attack surface for indirect prompt injection because its core purpose is to ingest and synthesize content from external, untrusted sources such as academic PDFs and web search results.
Ingestion points: The agent uses read_pdf to extract full text from remote URLs and Tavily for general web content, which is then processed to create "Evidence Cards."
Boundary markers: The instructions lack explicit boundary markers or warnings to ignore embedded instructions within the ingested papers.
Capability inventory: The skill possesses the ability to write to the local filesystem (creating markdown and JSON artifacts) and execute included shell scripts (scripts/).
Sanitization: There is no evidence of sanitization of the extracted text before it is used to populate metadata in references.json.
[COMMAND_EXECUTION]: The skill includes local bash scripts that perform destructive actions based on the content of AI-generated metadata files.
Evidence: The scripts/research-cleanup.sh script parses references.json using jq to find file paths listed in the pdf_path field and executes rm -f "$pdf_path" on them.
Risk: A malicious actor could provide a research paper that tricks the AI into recording a sensitive system path (e.g., ~/.bashrc or ~/.ssh/id_rsa) in the references.json file. When the cleanup script is eventually executed, it will delete the targeted file.
Shell Injection: In scripts/lib/research-utils.sh, the function create_research_question_file uses sed to replace placeholders: sed -i.bak "s/{Topic}/$topic/g" "$question_path". If the research topic name is specifically crafted (e.g., containing /g; s/.*/malicious/g; s/), it could lead to arbitrary text modification in the project files.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch documents from remote academic repositories.
Evidence: Instructions in guides/guide-workflow.md and SKILL.md detail downloading PDFs from DOIs and arXiv URLs into .ada/temp/research/downloads/.
Context: These downloads target well-known academic services (e.g., OpenAlex, arXiv) and are documented as part of the intended functionality. These findings are noted neutrally as they align with standard research workflows.

research