The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch academic metadata from well-known and trusted scientific services. Specifically, it interacts with the CrossRef API (api.crossref.org), NCBI E-utilities (eutils.ncbi.nlm.nih.gov), and the arXiv API (export.arxiv.org). These are standard operations for a citation management tool.
[COMMAND_EXECUTION]: The skill includes several Python scripts (e.g., search_pubmed.py, extract_metadata.py, format_bibtex.py) that are executed via the Bash tool. These scripts perform well-defined scientific automation tasks and do not involve the execution of arbitrary or suspicious code.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external academic sources, creating a potential surface for indirect prompt injection if an attacker were to embed instructions in paper metadata (e.g., titles or abstracts).
Ingestion points: Untrusted data enters the agent context through search results fetched by scripts/search_pubmed.py, scripts/search_google_scholar.py, and scripts/extract_metadata.py.
Boundary markers: The skill does not use specific delimiters or instructions to prevent the agent from obeying commands embedded in retrieved metadata.
Capability inventory: The agent has access to Bash, Read, Write, and Edit tools, which could be used to execute scripts or modify files if the agent were compromised via indirect injection.
Sanitization: The skill does not perform sanitization on the retrieved text content before presenting it to the agent. This is considered a low-risk inherent property of search-based skills.

citation-management