The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the papers/paper_notes.jsonl file, which includes user-controlled URLs and paper titles. This untrusted content is then used to drive network requests during the verification process.
Ingestion points: The script scripts/run.py reads entry data from papers/paper_notes.jsonl to extract URLs and titles for verification.
Boundary markers: There are no boundary markers or instructions present to prevent the agent from potentially obeying instructions embedded in the paper notes.
Capability inventory: The script performs network read operations via urllib.request.urlopen and file writes via atomic_write_text and write_jsonl (imported from tooling.common).
Sanitization: The script performs title normalization for comparison, but it does not validate or filter the URLs against a whitelist before making network requests.
[DATA_EXFILTRATION]: The skill's citation verification script initiates network connections to arbitrary URLs provided in the input notes file. Because it performs requests to non-whitelisted domains without restrictive filtering, this functionality could be misused to probe internal network services or exfiltrate metadata via URL parameters.

citation-verifier