The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is vulnerable to command injection because user-supplied arguments (including search queries, paper IDs, and directory paths) are interpolated directly into shell command strings and Python heredocs. An attacker providing a crafted query containing shell metacharacters could execute arbitrary commands in the host environment.
Evidence: python3 "$SCRIPT" search "QUERY" --max MAX_RESULTS in Step 2.
Evidence: mkdir -p PAPER_DIR && python3 -c "..." in Step 4.
Evidence: User-provided values like QUERY, MAX_RESULTS, and PAPER_DIR are injected without sanitization into active code paths executed via Bash.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests untrusted data from an external source and processes it using high-privilege capabilities.
Ingestion points: Paper titles, authors, and abstracts are fetched from the arXiv API XML response in Step 2 and Step 3.
Boundary markers: Absent. No delimiters or instructions are used to separate paper content from the agent's internal instructions.
Capability inventory: The agent has Bash(*) and Write tool access, which are used in the same context as the processed data.
Sanitization: None. The skill directly formats external paper metadata into summaries and contributions without escaping or validation.
[EXTERNAL_DOWNLOADS]: The skill fetches paper metadata and downloads PDF files from arXiv (export.arxiv.org and arxiv.org). While these are trusted academic domains, the lack of input sanitization during the fetch process creates the secondary risks mentioned above.
[COMMAND_EXECUTION]: The fallback mechanism in Step 2 uses a Python heredoc (`python3
<<'PYEOF') where the QUERY` variable is placed directly inside a Python string literal. A malicious query could escape the string context to execute arbitrary Python code.

aris-arxiv