The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts (scripts/pdf_to_images.py and scripts/validate_presentation.py) that execute external system commands such as pdftoppm, convert (ImageMagick), and pdflatex. These calls are implemented using subprocess.run with list-based arguments and without the shell=True parameter, which is a best practice that prevents shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external scientific content (PDFs, PPTX files, and LaTeX source). While this constitutes an attack surface, the skill includes explicit instructions for the agent to convert PDFs to images rather than reading them directly as text to prevent buffer overflow issues, and the underlying scripts do not pass untrusted data into a shell context.
[REMOTE_CODE_EXECUTION]: The documentation mentions external dependencies like pdf2image, poppler-utils, and ImageMagick. These are standard, well-known tools required for the skill's functionality. There are no patterns of downloading and executing arbitrary code from untrusted remote sources.

scientific-slides