The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions in both SKILL.md and CLAUDE.md designed to override the agent's standard operating procedures. The directives "Do NOT explore or analyze first" and "IMMEDIATELY invoke the script" are concealment patterns that attempt to bypass the agent's chain-of-thought verification or manual code audit before execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (arXiv TeX sources) and converts it into a format specifically intended for "LLM consumption." This creates a surface for indirect prompt injection where a malicious document could influence or hijack the agent's behavior during the conversion or post-conversion review.
Ingestion points: arXiv IDs and URLs provided by the user or discovered automatically from local directory metadata.
Boundary markers: None specified in the instructions to prevent the model from obeying instructions embedded in the converted markdown.
Capability inventory: Execution of Python orchestrator and worker scripts (main.py, sub_agent.py); instructions for the agent to "follow its output" which grants the script influence over subsequent agent actions.
Sanitization: While the architecture mentions "Clean" and "Verify" steps, there is no evidence of sanitization specifically targeting the removal of adversarial prompt sequences from the processed TeX/Markdown content.
[COMMAND_EXECUTION]: The skill invokes a local Python module (skills.arxiv_to_md.main) and instructs the agent to follow the script's output without further analysis. This pattern creates a dependency where the agent's subsequent logic is determined by the output of a script it has been told not to audit.

arxiv-to-md