The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads PDF and TeX source files from arxiv.org and export.arxiv.org. These are well-known, trusted academic services. The script includes explicit domain validation to ensure it only interacts with the official arXiv infrastructure.
[COMMAND_EXECUTION]: The skill executes a local Python script bootstrap_arxiv_paper.py to initialize the workspace. This is a standard and safe use of scripts within a skill framework.
[DATA_EXFILTRATION]: No evidence of sensitive data access or unauthorized exfiltration was found. Network operations are limited to the primary purpose of fetching paper data from trusted repositories.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of academic papers (PDF/TeX). While this presents a theoretical surface for indirect injection, the skill's primary purpose is analysis, and the accompanying script includes path validation logic to ensure secure file handling. The risk is considered negligible given the intended use case and implemented safeguards.
[DYNAMIC_EXECUTION]: The script uses tarfile for extraction but implements a safety check to prevent 'zip-slip' (path traversal) attacks, ensuring that extracted files cannot be placed outside the designated project directory.

paper-interpreter