The Agent Skills Directory

[COMMAND_EXECUTION]: The skill identifies and executes local Python scripts (arxiv_fetch.py, semantic_scholar_fetch.py) using the Bash tool. It interpolates the user-provided research topic (QUERY) directly into shell command strings (e.g., python3 "$SCRIPT" search "QUERY"). If the agent fails to sanitize the input, an attacker could use shell metacharacters to perform arbitrary command execution.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8).
Ingestion points: The skill reads the first three pages of local PDFs (papers/**/*.pdf), Zotero annotations, and Obsidian vault notes to summarize content.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from obeying instructions embedded within the academic papers or user notes.
Capability inventory: The agent is granted Bash(*), Write, and WebSearch permissions. A malicious PDF could contain instructions that trigger these tools to exfiltrate data or modify the file system.
Sanitization: No validation or escaping mechanism is mentioned for the text extracted from external sources.
[DATA_EXPOSURE]: The skill accesses sensitive user data repositories, including Zotero libraries, Obsidian vaults, and local project directories. While this is the intended primary purpose of the skill, the wide access surface increases the potential impact of a prompt injection attack.

research-lit