The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/route_and_invoke.py uses subprocess.run to execute the internal validation script validate_handoff.py. This is implemented safely using a list of arguments and avoiding shell execution, which prevents command injection at the script level.
[PROMPT_INJECTION]: Review of SKILL.md and related documentation shows no attempts to override agent behavior, bypass safety filters, or extract system prompts. The instructions follow standard academic workflow patterns.
[DATA_EXFILTRATION]: No network operations (e.g., curl, wget, requests) or access to sensitive file paths (e.g., .ssh, .aws, .env) were detected. The skill only interacts with local project files defined in the paper-writing workflow.
[INDIRECT_PROMPT_INJECTION]: The skill generates recommended shell commands for the user that interpolate content from local project files, such as topic-brief.md, using shell subcommands like $(head -1 ...). This creates a theoretical surface for command injection if a user copy-pastes the recommendation and the source file contains malicious shell characters.
Ingestion points: brief/topic-brief.md, brief/contribution-map.yaml, brief/evidence-matrix.csv, plan/outline-contract.md, plan/router-decision.md.
Boundary markers: Not applicable for printed console instructions.
Capability inventory: Execution of a local Python validation script; generation of shell command templates for user execution.
Sanitization: None; the printed instructions assume the project files contain valid academic content without shell-active characters.

paper-from-zero