The Agent Skills Directory

[COMMAND_EXECUTION]: The bash wrapper executes several local commands, including the cdp.mjs tool (from the chrome-cdp skill) and python3. This is necessary for browser automation and plan validation.
[DYNAMIC_EXECUTION]: The skill dynamically generates JavaScript code to be evaluated in the browser's context. Security is maintained by using Python's json.dumps() in plan_tools.py to sanitize the file names and comment text before they are interpolated into the JavaScript strings, preventing cross-context injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes a JSON plan file provided by the user or an agent. This represents an attack surface for indirect prompt injection if the plan contains malicious text meant for the reader of the Overleaf document. The skill treats this data as text to be typed into the Overleaf UI and applies sanitization to prevent it from affecting the skill's execution logic.
Ingestion points: The overleaf-comment script reads the plan file path and passes it to plan_tools.py for validation and processing.
Boundary markers: Input is structured as a JSON array of objects, which are parsed by the Python helper.
Capability inventory: The skill can navigate the file tree in the browser tab and post comments via the Chrome DevTools Protocol.
Sanitization: plan_tools.py uses json.dumps() to escape all string data before it is passed back to the bash wrapper and evaluated in the browser context.

overleaf-comment