The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests raw external reviews which can contain malicious instructions intended to manipulate the agent's output.
Ingestion points: Raw reviews are loaded into the environment in Phase 1 and Phase 2 (SKILL.md).
Boundary markers: Review text is stored verbatim in rebuttal/REVIEWS_RAW.md but lacks explicit boundary markers or instructions to ignore embedded commands during subsequent processing phases.
Capability inventory: The skill can execute Bash(*) commands and invoke other agents or skills (e.g., experiment-bridge).
Sanitization: No sanitization is performed on review contents before they are used to influence the drafting and strategy planning phases.
[COMMAND_EXECUTION]: The workflow involves the execution of local shell commands via Bash(*) and the potential invocation of the /experiment-bridge skill to run supplementary experiments. This allows the agent to modify the local environment based on instructions derived from processed data, though it is gated by the AUTO_EXPERIMENT setting.
[DATA_EXFILTRATION]: In Phase 6, the skill uses the mcp__codex__codex tool to stress-test the rebuttal draft. This process involves sending the paper source, raw reviews, and the draft to an external model (gpt-5.4), which represents a transfer of potentially sensitive research data to an external service provider.
[NO_CODE]: The skill consists of instructional logic within the Markdown body and does not include separate script files, executables, or binaries.

rebuttal