The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill performs data transformation on workspace files that could contain malicious instructions.
Ingestion points: The main function in scripts/run.py reads data from outline/outline.yml, citations/ref.bib, and multiple .jsonl files (e.g., subsection_briefs.jsonl) within the provided workspace.
Boundary markers: There are no delimiters or instructions used to prevent the agent from interpreting data within these files as commands in downstream tasks.
Capability inventory: The skill has file-system capabilities including reading workspace files and writing/modifying JSONL files in-place using write_jsonl and backup_existing from the local tooling.common module.
Sanitization: While the script validates JSON structure, it does not sanitize or filter the content of string fields (such as title, section_title, or bibkey) which are copied directly from input files to the output artifacts. If an input file is compromised with malicious instructions, these will be propagated to the normalized output files.

schema-normalizer