The Agent Skills Directory

[PROMPT_INJECTION]: The skill interpolates user input directly into the top-level prompt without protection.
Evidence: The line Search for relevant papers on: $ARGUMENTS lacks delimiters (such as triple quotes or XML tags) to prevent user-supplied topics from containing instructions that could override the skill's logic.
[INDIRECT_PROMPT_INJECTION]: The skill extracts and summarizes content from local files that could contain malicious instructions.
Ingestion points: The process reads .bib files from ~/code, ~/paperpile-bib, and the project root, including fields like abstracts and titles.
Boundary markers: No delimiters or "ignore instructions" warnings are used when the agent processes the extracted text.
Capability inventory: The agent uses its internal reasoning to summarize top papers and identify gaps, creating an opportunity for embedded instructions in paper abstracts to influence agent behavior.
Sanitization: There is no logic to sanitize or escape data read from the local bibliography files before the agent analyzes it.

literature-search