The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted metadata, including titles and abstracts, from external academic APIs (OpenAlex, Semantic Scholar, Crossref) which is then used in AI prompts for relevance scoring and content generation. This creates an attack surface for indirect prompt injection if an attacker can influence the metadata in these public databases.\n
Ingestion points: multi_query_search.py and openalex_search.py collect data from remote APIs into papers.jsonl files.\n
Boundary markers: The scoring prompt in references/ai_scoring_prompt.md uses clear section headers to separate instructions from paper data.\n
Capability inventory: The skill invokes local command-line tools like xelatex, bibtex, and pandoc via subprocess.run calls in the pipeline runner.\n
Sanitization: select_references.py and build_reference_bib_from_papers.py implement escaping logic for LaTeX special characters to prevent compilation errors and potential injection into the TeX source.\n- [COMMAND_EXECUTION]: The core workflow uses subprocess.run to execute research-related binaries (xelatex, bibtex, pandoc) for converting LaTeX sources into PDF and Word documents. These calls are made within the context of the user's local environment to fulfill the skill's primary purpose.\n- [REMOTE_CODE_EXECUTION]: The script scripts/compile_latex_with_bibtex.py invokes shell commands using shell=True to configure environment variables for the TeX compiler. While the script uses shlex.quote to sanitize arguments, this pattern is less secure than direct environment passing and presents a minor risk of command injection if the construction logic is ever compromised.

systematic-literature-review