The Agent Skills Directory

[COMMAND_EXECUTION]: Several Python scripts utilize subprocess.run and subprocess.Popen to invoke local document processing tools such as pandoc, xelatex, and pdftoppm. These invocations are limited to specific tasks related to manuscript export, visual readiness checks, and equation rendering, and are performed with validated or hardcoded arguments.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to trusted or well-known domains. scripts/paperspine_update.py fetches update metadata and ZIP archives from the author's official repository on GitHub (github.com/WUBING2023/PaperSpine). Additionally, multiple scripts query the Crossref API (api.crossref.org) for legitimate bibliographic metadata verification. These operations are transparent and essential to the skill's purpose.
[INDIRECT_PROMPT_INJECTION]: As the skill is designed to ingest and refine user-provided drafts and external research materials, it has an inherent surface for indirect prompt injection. However, this risk is mitigated by a comprehensive internal auditing system. The skill includes numerous 'guard' scripts (latex_guard.py, word_guard.py, integrity_audit.py, etc.) that scan for hallucinations, meta-narrative leaks, and structural inconsistencies in the manuscript content.
[DATA_EXFILTRATION]: While the skill handles sensitive research data, no evidence of malicious data exfiltration was found. On the contrary, scripts/open_release.py explicitly scans project files for sensitive patterns like SSH keys and API tokens to prevent them from being accidentally included in public releases, acting as a proactive security feature.

paper-spine