The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of parsing untrusted external inputs.
Ingestion points: Defined in SKILL.md under Round 1 and Round 2, where the agent reads paper content from arXiv URLs, PDFs, or raw text, and extracts/reads file content from public GitHub repositories.
Boundary markers: Absent. There are no specialized delimiters or structural constraints guarding the input prompt interpolation to prevent instructions embedded within the academic papers from hijacking the agent workflow.
Capability inventory: The agent can execute system commands (git clone), browse files, and write HTML output files.
Sanitization: Absent. The external data is consumed and directly rendered into HTML blocks without rigorous input sanitization.
[COMMAND_EXECUTION]: In SKILL.md, the instruction git clone --depth 1 <url> /tmp/paper_code relies on a URL dynamically extracted from the body of untrusted academic papers. If the paper contains malicious shell metadata or unvalidated input inside the repository link, it poses a risk of command injection depending on how the runtime parses the argument.
[INDIRECT_PROMPT_INJECTION]: The HTML template specified in SKILL.md configures the Mermaid diagram rendering engine with securityLevel: 'loose'. This configuration choice means that if a processed paper successfully injects script tags or malicious attributes into the generated diagram markup, it could trigger a Cross-Site Scripting (XSS) vulnerability when the output HTML is opened in a web browser.

paper-analyzer