The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run and os.execvp for internal orchestration and utility calls.
In scripts/p2z.py, a dispatcher replaces its own process with uv run to execute helper scripts within the same directory. This is restricted to local files identified via glob.
In scripts/p2zlib/zotero.py, subprocess.run is used to call the system utility wslpath to handle Windows-style file paths when running in WSL environments.
[DYNAMIC_EXECUTION]: The dispatcher scripts/p2z.py dynamically selects and executes scripts from the scripts/ directory based on user commands. The selection is validated against the actual file system contents to prevent arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The skill implements a multi-agent decomposition pattern where sub-agents (Judges) are assigned tasks via handoff files. This creates a vulnerability surface where malicious metadata in a paper (e.g., a crafted title or abstract) could attempt to influence the behavior of the sub-agent.
Ingestion points: Untrusted data enters the agent context through .bib file imports (scripts/read_bib.py) and paper metadata retrieved from the Zotero API.
Boundary markers: Data is passed between agents using structured JSON handoff files (e.g., <imp>/handoffs/<slug>.<n>.json).
Capability inventory: The skill has capabilities for local file system access, network communication with a local Zotero instance (127.0.0.1), and internal script execution.
Sanitization: The skill relies on JSON structuring and explicit instructions in sub-agent briefs (e.g., references/same-paper-judge.md) which include instructions like "Do the work yourself; send no subagents" and "Touch no website" to mitigate risks.

paper-to-zotero