The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file instructs the agent to execute a local Python script (scripts/generate_schematic.py) using the Bash tool to generate mandatory visual elements. This script is missing from the provided file set, which prevents a full security review of the actions it performs. Executing unverified local scripts can lead to unintended side effects on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where user-provided strings are interpolated directly into shell commands. The instruction python scripts/generate_schematic.py "your diagram description" does not specify any sanitization or escaping requirements for the description variable. A malicious user could provide a description containing shell meta-characters (e.g., ;, |, `) to execute arbitrary commands with the privileges of the agent.
Ingestion points: User-supplied diagram descriptions are used as CLI arguments.
Boundary markers: Absent; the input is wrapped in double quotes but lacks instruction for handling internal quotes or escapes.
Capability inventory: The skill explicitly requests the Bash tool, enabling the execution of shell commands.
Sanitization: No evidence of input validation or sanitization logic is provided in the skill instructions.
[METADATA_POISONING]: The skill's documentation (README.md and SKILL.md) references a large number of internal files (e.g., references/nsf_guidelines.md, references/nih_guidelines.md, references/research_methods.md) and scripts that are not present in the skill folder. This is deceptive regarding the skill's actual capabilities and may cause the agent to fail or hallucinate content when attempting to access these non-existent resources.
[PROMPT_INJECTION]: The skill uses authoritative language (e.g., "⚠️ MANDATORY", "This is not optional") to force the agent into a specific automated behavior (running the schematic script before finalizing documents). This acts as a behavioral override that restricts the agent's autonomy and could be used to ensure the execution of the vulnerable command execution path mentioned above.

research-grants