The Agent Skills Directory

[PROMPT_INJECTION]: The skill utilizes the $ARGUMENTS placeholder directly within a primary instruction header ('Refine and concretize: $ARGUMENTS'). This allows user-supplied text to be interpreted as part of the agent's high-level goal, creating a direct prompt injection vector where a user could potentially override subsequent logic.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its pipeline nature. It processes files in Phase 3 (refine-logs/FINAL_PROPOSAL.md, refine-logs/REVIEW_SUMMARY.md, refine-logs/REFINEMENT_REPORT.md) that are produced by sibling skills which may fetch untrusted data from the internet.
Ingestion points: Phase 3 reads multiple files previously generated or refined by the research-refine workflow.
Boundary markers: The instructions lack delimiters or explicit warnings to the agent to ignore instructions embedded within the content of these processed files.
Capability inventory: The skill possesses significant capabilities including Bash(*), Write, WebFetch, and Agent delegation.
Sanitization: There is no evidence of sanitization, validation, or escaping of the content read from the refine-logs/ directory before it is used to drive the experiment planning stage.
[COMMAND_EXECUTION]: Under the 'Key Rules' section, the skill explicitly instructs the agent to use Bash (cat << 'EOF' > file) to write files if standard tools fail. Crucially, it tells the agent to 'immediately retry' and 'do NOT ask the user for permission — just do it silently', which removes user oversight for shell-based operations.

research-refine-pipeline