The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill directs the agent in references/consistency.md to "compile using its existing build workflow when available" and "render the affected pages to inspect clipping". This instruction requires the agent to execute arbitrary build systems (such as make, latexmk, or custom shell scripts) found within the user-provided project directory, constituting runtime execution of local code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, including research manuscripts, LaTeX source code, and data from external primary sources via tools like research-evidence. Because the agent is instructed to compile and render this source material, it is vulnerable to indirect injection where a malicious manuscript could trigger dangerous shell commands (e.g., via the LaTeX \write18 command) or utilize malicious build configurations to exfiltrate data or compromise the agent's execution environment.
Ingestion points: Research manuscripts and LaTeX source files (SKILL.md, references/consistency.md), and external metadata/citations (references/related-work.md).
Boundary markers: Absent; the instructions emphasize academic consistency but do not define security boundaries for the build environment.
Capability inventory: File system access (reading/writing manuscripts), shell command execution (compilation/rendering), and potential network access for evidence verification.
Sanitization: None mentioned for LaTeX source code or build configuration files.
[COMMAND_EXECUTION]: By instructing the agent to invoke the project's own build workflow and rendering tools, the skill exposes the agent to command injection if the user-provided project contains maliciously crafted build automation files.

paper-writing