The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive personal and project files, including cv.md, bio.md, CV.pdf, and publications.md. This data is incorporated into a grant proposal which is then transmitted to an external OpenAI model via the mcp__codex__codex tool for evaluation and feedback. Additionally, the skill attempts to read ~/.claude/feishu.json to send notifications to an external Feishu/Lark service.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform file system operations, such as writing large files in chunks and managing the output directory. It also generates and executes code (SVG or Python with matplotlib) to produce diagrams and figures for the proposal.
[EXTERNAL_DOWNLOADS]: To ground the proposal in current research, the skill performs automated web searches and fetches content from academic databases (e.g., arXiv, KAKEN, NSF Award Search). This external data is used to formulate gap statements and landscape analyses.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from web searches and external literature. This ingested content is processed and passed to another AI model (Codex) without explicit boundary markers or sanitization, potentially allowing malicious instructions embedded in research papers or web pages to influence the drafting or review process.
Ingestion points: WebFetch (via /research-lit), local project files (IDEA_REPORT.md, etc.).
Boundary markers: Absent. External content is interpolated directly into drafting and review prompts.
Capability inventory: Subprocess calls (Bash), file-write operations, and network operations (Codex MCP, WebFetch).
Sanitization: None detected.

grant-proposal