The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads untrusted external data (academic papers) without appropriate boundary markers or sanitization, creating a surface for indirect prompt injection.\n
Ingestion points: Paper content is read in SKILL.md via pdfplumber and read_latex_file.\n
Boundary markers: None identified in instructions to separate user data from system instructions.\n
Capability inventory: The skill has file-writing capabilities for generating review reports.\n
Sanitization: No text sanitization or instruction-filtering is mentioned before the LLM analyzes the paper.\n- [DYNAMIC_EXECUTION]: The recursive logic provided for reading LaTeX files in SKILL.md is susceptible to a Denial of Service (DoS) attack. Specifically, the read_latex_file function follows \\input and \\include commands without cycle detection, allowing circular references to exhaust system resources.\n- [COMMAND_EXECUTION]: The implementation guidance for LaTeX processing contains a path traversal vulnerability. The code uses os.path.join(os.path.dirname(filepath), inc) where inc is extracted directly from the file content via regex. An attacker could craft a paper that references files outside the workspace (e.g., \\input{/etc/passwd} or \\input{../.env}) which the agent might then read.

paper-review