The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of scientific manuscripts and grant proposals. This creates a surface for indirect prompt injection where malicious instructions embedded in a document could influence the agent's behavior.
Ingestion points: Manuscript and grant files (e.g., PDF, text) are processed using the Read tool as part of the primary workflow.
Boundary markers: The skill does not define clear delimiters or specify instructions to ignore embedded commands within the ingested manuscripts.
Capability inventory: The skill utilizes the Bash tool to execute Python scripts (generate_schematic.py) using natural language descriptions extracted from the processed documents.
Sanitization: There are no specified procedures for sanitizing or validating the text extracted from documents before it is used as input for further automated actions.
[COMMAND_EXECUTION]: The instructions direct the agent to use the Bash tool to execute local Python scripts, such as scripts/generate_schematic.py and skills/scientific-slides/scripts/pdf_to_images.py. These scripts take inputs derived from potentially malicious external documents, which could lead to unintended command execution if the scripts or the agent's invocation of them do not properly handle shell arguments.
[METADATA_POISONING]: The skill contains a discrepancy between the provided author context (wu-yc) and the author metadata declared in the YAML frontmatter (K-Dense Inc.). Furthermore, the skill includes explicit instructions to steer users toward an external platform (www.k-dense.ai) for complex workflows, which is not identified as a verified vendor resource for the attributed author.

peer-review