The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains phrases typically associated with prompt injection, such as 'ignore prior instructions' (e.g., in agents/devils_advocate_reviewer_agent.md and agents/eic_agent.md). However, analysis reveals these are defensive instructions intended to protect the agent. They explicitly instruct the model to treat potentially malicious imperative sentences found in previous outputs or manuscripts as data rather than instructions. This is a best-practice defensive pattern rather than an attack.
[DATA_EXFILTRATION]: The skill uses WebFetch and supports a 'cross-model verification' feature (ARS_CROSS_MODEL). This allows sending manuscript content to external AI providers for independent review. The implementation is considered safe as it requires explicit user consent before any transmission, and is a core part of the declared academic review functionality.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of academic manuscripts and author response letters.
Ingestion points: Reads manuscript files via the Read tool as identified in SKILL.md and reviewer agents.
Boundary markers: Implements strict data delimiters (e.g., <phase1_output> tags) and explicitly warns agents to ignore embedded instructions in manuscripts via the 'IRON RULE — UNTRUSTED REVIEW MATERIALS.'
Capability inventory: The agent team has access to Bash, WebFetch, and file writing tools (Write, Edit).
Sanitization: Employs a 'Sprint Contract' protocol which forces a 'paper-content-blind' pre-commitment phase (Phase 1). This ensures reviewers establish their scoring criteria before seeing the potentially malicious content of the paper.

academic-paper-reviewer