The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The SKILL.md file contains instructions to install mandatory CLI tools using curl -fsSL https://parallel.ai/install.sh | bash. This pattern involves downloading an opaque script from an untrusted third-party domain and executing it directly in the shell, which can lead to complete system compromise.
[EXTERNAL_DOWNLOADS]: The skill relies on fetching content from a wide variety of external academic databases and preprint servers. While some sources are well-known, the skill also utilizes parallel-cli to extract content from arbitrary URLs, increasing the risk of exposure to malicious payloads.
[COMMAND_EXECUTION]: Several bundled Python scripts (scripts/generate_pdf.py, scripts/generate_schematic.py, and scripts/generate_schematic_ai.py) utilize subprocess.run() to invoke system binaries like pandoc and xelatex, as well as other Python processes. If the inputs to these scripts (e.g., paper titles or generated prompts) are manipulated, they could be used to execute arbitrary commands.
[PROMPT_INJECTION]: The skill exhibits a significant surface for Indirect Prompt Injection and Metadata Poisoning. It is designed to ingest and process large volumes of untrusted literature data without using boundary markers or sanitization logic. This could allow an attacker to embed malicious instructions within an academic paper that the agent then 'obeys' during synthesis. Additionally, there is a discrepancy between the provided author context ('tassiovale') and the author listed in the skill's metadata ('K-Dense Inc.'), which is misleading.
Ingestion points: Content fetched via parallel-cli search and extract, stored in sources/ and aggregated JSON files.
Boundary markers: Absent. The skill does not delineate external content from its own instructions.
Capability inventory: Shell access (Bash), file system operations (Read, Write, Edit), and subprocess execution.
Sanitization: Absent. The skill does not validate or clean literature data before use.

literature-review