The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external referee reports and manuscripts. This introduces a surface where malicious instructions embedded in those documents could attempt to influence the agent's behavior during the response generation phase.
Ingestion points: Paths provided via $0 (referee report) and $1 (revised manuscript) are read and processed in SKILL.md Step 1 and Step 2.
Boundary markers: The instructions do not specify the use of clear delimiters or explicit instructions for the agent to ignore prompt injection attempts within the provided files.
Capability inventory: The skill has access to powerful tools including Write, Edit, and Bash, which increases the potential impact of a successful injection.
Sanitization: While files are converted to plain text, there is no evidence of specific sanitization or filtering to remove potential instruction-like content from the text.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform file format conversions using system utilities.
Evidence: Found in Step 0 of SKILL.md, the skill executes shell commands like TMP=$(mktemp --suffix=.txt) && pdftotext "FILE" "$TMP" and pandoc "FILE" -t plain -o "$TMP".
Mitigation: The instructions follow security best practices by using mktemp to generate non-predictable temporary file paths and double-quoting the FILE variable to mitigate potential shell injection vulnerabilities arising from filenames containing spaces or special characters.

respond-to-referees