The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to configure and install MCP servers from external, unvetted GitHub repositories: blazickjp/arxiv-mcp-server, grll/pubmedmcp, and 54yyyu/zotero-mcp. These sources are not affiliated with recognized trusted organizations.
[REMOTE_CODE_EXECUTION]: By recommending the execution of external packages via uvx from unverified third-party GitHub accounts, the skill introduces a risk where the agent could execute malicious code if those repositories are compromised.
[COMMAND_EXECUTION]: The skill uses shell-level operations, including uvx for tool execution and curl for interacting with the local Zotero API (http://localhost:23119).
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8):
Ingestion points: Untrusted data enters the agent context via mcp__arxiv-mcp-server__read_paper, mcp__pubmed-mcp-server__pubmed_search_articles, and mcp__zotero__zotero_get_item_fulltext (SKILL.md, references/WORKFLOW.md).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious instructions embedded within the research papers being read.
Capability inventory: The agent has access to Bash, Write, Edit, and WebFetch tools, which could be leveraged if a paper contains an injection attack.
Sanitization: There is no evidence of filtering or sanitization of the content fetched from ArXiv, PubMed, or Zotero before it is processed by the agent.

medical-imaging-review