The Agent Skills Directory

Prompt Injection (LOW): The skill exhibits an indirect prompt injection surface (Category 8) inherent to literature review tools.
Ingestion points: scripts/search_databases.py ingests and parses results.json files; scripts/generate_pdf.py ingests and processes Markdown files.
Boundary markers: Absent. The scripts do not use specific delimiters or instructions to the LLM to ignore embedded commands within the ingested academic data.
Capability inventory: scripts/generate_pdf.py can execute system commands (pandoc, xelatex) and read/write local files; scripts/verify_citations.py performs network operations.
Sanitization: No sanitization or escaping is applied to citation metadata or search results before they are formatted into Markdown, BibTeX, or PDF, which could allow an attacker to embed malicious LaTeX or Markdown instructions in a research paper's metadata.
Command Execution (LOW): scripts/generate_pdf.py utilizes subprocess.run to call external binaries. While it correctly uses list-based arguments to prevent shell injection, the execution of complex tools like pandoc and xelatex on untrusted input carries a baseline risk of exploitation through document-based attack vectors (e.g., LaTeX \input commands).
External Downloads (SAFE): scripts/verify_citations.py makes outbound HTTP requests to academic metadata providers (doi.org and crossref.org). These are legitimate, purpose-specific API calls and do not involve downloading or executing remote code.

literature-review