The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) due to the way it handles data retrieved from external sources and user input during the automated schematic generation process.
Ingestion points: The skill ingests untrusted data from literature searches (via the research-lookup tool) and user-supplied text descriptions provided during document drafting in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters used to separate untrusted content from research papers or user input, nor are there warnings to the agent to ignore any embedded directives in processed literature.
Capability inventory: The skill possesses the Bash tool and instructs the agent to execute shell commands, specifically python scripts/generate_schematic.py "[description]", where the description is constructed from potentially untrusted sources.
Sanitization: The instructions lack requirements for sanitizing or escaping the interpolated data before it is executed in a shell environment, which could allow for command injection if the input contains shell metacharacters.
[COMMAND_EXECUTION]: The skill uses the Bash tool to compile LaTeX documents and run local Python scripts. While these are necessary for the skill's primary function, the execution of shell commands based on dynamic, unsanitized strings from research data represents a security risk.
Evidence: SKILL.md directs the agent to run commands like python scripts/generate_schematic.py "..." and xelatex report.tex.

scientific-writing