The Agent Skills Directory

[COMMAND_EXECUTION]: User-controlled input from $ARGUMENTS is directly interpolated into bash commands and Python code strings across multiple steps. For example, in Step 2, the QUERY is placed directly into a bash command and an inline Python script. An attacker can craft a query containing shell metacharacters like ;, $(...), or | to execute arbitrary commands, or Python escape sequences to execute arbitrary Python code.
[COMMAND_EXECUTION]: The skill allows the user to specify a directory (PAPER_DIR) and uses it in a mkdir -p command without validation. This presents a path traversal risk, as a user could provide a path to a sensitive system directory.
[EXTERNAL_DOWNLOADS]: The skill downloads PDF documents from arXiv's official repository. While the source itself is a well-known and legitimate academic service, the skill constructs the local destination path using the user-provided PAPER_DIR and ARXIV_ID. Without sanitization, a malicious ID like ../../filename could be used to write files to arbitrary locations on the filesystem.

arxiv