The Agent Skills Directory

[DATA_EXFILTRATION]: Accesses the hidden configuration file ~/.claude/feishu.json in the user's home directory.
This file is used for managing notifications and typically contains sensitive authentication tokens or API credentials.
[COMMAND_EXECUTION]: Explicitly directs the agent to execute Bash commands for file operations without user oversight.
The instructions mandate that the agent should "NOT ask the user for permission — just do it silently" when using cat to write files if the standard writing tool fails.
[PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection via external data ingestion.
Ingestion points: Ingests data from RESEARCH_BRIEF.md, ArXiv PDFs, and arbitrary URLs via WebFetch (SKILL.md).
Boundary markers: Absent; external content is treated as the "primary context" for the entire automated pipeline.
Capability inventory: Employs high-privilege tools including Bash(*), Agent, Skill, and MCP codex tools (SKILL.md).
Sanitization: There is no evidence of sanitization or delimiters used to isolate external instructions from the agent's core logic.
[EXTERNAL_DOWNLOADS]: Downloads research papers from ArXiv and other remote content via WebFetch for use in the discovery pipeline.
[REMEDIATION]:
Implement strict boundary markers (e.g., <external_content> tags) around data fetched from ArXiv or the web.
Ensure the agent always requests confirmation before executing shell commands, regardless of previous tool failures.
Verify the security of the Feishu webhook and restrict access to home directory configuration files.

aris-idea-discovery