The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted external sources, including scholarly APIs (arXiv, Semantic Scholar, Crossref, OpenAlex) and remote notebooks (NotebookLM, Zotero). While this creates an attack surface for indirect prompt injection, the skill incorporates significant mitigations.
Ingestion points: Data enters the context through research-hub search adapters, scholarly API connectors, and reference library syncs (identified in references/tool-adapters.md).
Boundary markers: The skill architecture mandates a ResearchEvidencePacket structure and a deterministic validator to separate raw prose from structured context (identified in references/evidence-agent-harness.md).
Capability inventory: The agent can write to local files, execute simulation commands, and perform external writes to GitHub or Zotero, but these are protected by mandatory human gates (external_write, experiment_authorization, release_authorization).
Sanitization: The Evidence Verifier and Contradiction/Falsifier roles are designed to validate claims against multiple sources before a human semantic gate allows advancement.
[COMMAND_EXECUTION]: The execute stage and tool-adapters.md mention running project-specific code, simulation pipelines, and Jupyter notebooks. This execution is scoped to the project environment and is explicitly gated by experiment_authorization, which requires a human to review the exact command and resource estimates before execution.
[EXTERNAL_DOWNLOADS]: The skill integrates with multiple well-known scholarly platforms and reference managers. These interactions are consistent with the skill's primary purpose and target established research services, posing minimal risk when handled via the prescribed human-authorized adapters.

research-workflow-orchestrator