The Agent Skills Directory

[COMMAND_EXECUTION]: Several shell commands in Step 1 and Step 6 interpolate variables sourced from external APIs and user input without proper sanitization. Specifically, commands like python3 "$SCRIPT" search "QUERY" and python3 tools/research_wiki.py slug "<title>" --author "<last>" use double quotes which are insufficient to prevent command injection from variables containing shell metacharacters, backticks, or subshell expansions (e.g., $(...)).
[REMOTE_CODE_EXECUTION]: The command injection vulnerabilities identified in the shell command construction allow for arbitrary code execution on the host system. An attacker could exploit this by crafting a research paper with a malicious title that, when retrieved via WebSearch or arXiv API, triggers shell execution when the skill attempts to generate a slug or update the research wiki.
[EXTERNAL_DOWNLOADS]: The skill optionally downloads PDF files from arXiv when ARXIV_DOWNLOAD is set to true. While arXiv is a well-known academic service, the download path and ID are passed to a shell script, contributing to the injection surface.
[PROMPT_INJECTION]: The skill processes untrusted external data (web search results, PDF abstracts, and Zotero annotations) and has access to powerful tools like Bash(*), making it a target for indirect prompt injection.
Ingestion points: WebSearch results, arXiv metadata, and local PDF content (SKILL.md).
Boundary markers: Absent.
Capability inventory: Bash(*), Write, Agent, and MCP tool access (SKILL.md).
Sanitization: None identified.

aris-research-lit