The Agent Skills Directory

Indirect Prompt Injection Surface: The skill fetches and processes significant amounts of untrusted data from external sources (academic papers via arXiv, OpenAlex, Semantic Scholar, and OpenReview). If a paper contains malicious prompt instructions in its abstract or method section, it could influence the agent's behavior during analysis phases.
Ingestion points: Data enters the system via scripts/search_arxiv.py, scripts/search_openalex.py, scripts/search_semanticscholar.py, scripts/search_openreview.py, and scripts/fetch_sections.py. Results are stored in phase0/lit_results.json and phase0/fulltext_cache.json.
Boundary markers: Boundary markers are largely absent in prompts like references/system-prompts/bottleneck_identify.txt and references/system-prompts/ideate_generate.txt when interpolating fetched paper content.
Capability inventory: The orchestrator scripts/run.py has the ability to execute shell commands, write to the file system, and perform network operations.
Sanitization: There is no specific sanitization or filtering of fetched paper content before it is processed by the agent.
Command Execution through Configuration: The scripts scripts/intent.py and scripts/pattern_summary.py use subprocess.run with shell=True to execute commands defined in the environment variables NOVELTY_LLM_REASONING_LARGE_CMD and NOVELTY_LLM_CLASSIFY_FAST_CMD. This is a design choice to allow users to configure their own LLM interfaces, but it means that the environment in which the skill runs must be trusted, as an attacker controlling these variables could execute arbitrary shell commands.
External Data Retrieval: The skill makes legitimate network requests to several well-known academic domains to gather research data. While these are trusted services, the skill downloads and processes PDFs and HTML content from them, which is a necessary but potentially risky operation if the source content is compromised.

idea-spark