The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process academic paper metadata from external sources, creating a surface for potential prompt injection via malicious paper titles or abstracts.
Ingestion points: The skill fetches Atom XML from export.arxiv.org and JSON data from api.semanticscholar.org (found in SKILL.md).
Boundary markers: Data is parsed and directly outputted or passed to other tools (like web_extract) without explicit boundary markers or instructions to ignore embedded commands.
Capability inventory: The agent has network access via curl, the ability to extract web content using web_extract, and local command execution via python -c.
Sanitization: Basic string cleaning is performed (e.g., .strip(), .replace('\n', ' ')), but no security-focused sanitization is implemented to prevent the agent from following instructions embedded in research abstracts.
[COMMAND_EXECUTION]: The skill provides numerous examples of piping network output directly into a Python interpreter for processing.
Evidence: Multiple instances in SKILL.md where curl commands are piped to python -c to execute multi-line XML or JSON parsing scripts provided within the skill content.
Context: While automated scanners flagged these as remote code execution, the code executed is statically defined within the skill body and is used for parsing data from trusted academic APIs, rather than executing downloaded remote scripts.
[EXTERNAL_DOWNLOADS]: The skill connects to well-known academic services to retrieve paper data.
Details: Regularly fetches metadata and citation information from export.arxiv.org and api.semanticscholar.org. These are recognized as legitimate, well-known services for academic research.

arxiv