The Agent Skills Directory

[CREDENTIALS_UNSAFE]: An example command in SKILL.md demonstrates how to extract an API key from a hardcoded filesystem path (/Users/lingzhi/Code/keys.md) using a shell pipeline (grep S2_API_Key ... | cut -d: -f2). Hardcoding specific paths to secret files and providing instructions for their extraction is a high-risk pattern that can lead to credential exposure.
[DATA_EXFILTRATION]: The skill documentation establishes a pattern where sensitive local credentials (the API key) are retrieved and then passed as parameters to scripts that perform network requests. This creates a potential vector for exfiltrating local secrets to external services.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted LaTeX content in harvest_citations.py to generate search queries for the Semantic Scholar API.
Ingestion points: The harvest_citations.py script reads user-provided .tex files to find "uncited claims".
Boundary markers: Absent. The script processes text segments directly without delimiters or instructions to ignore embedded malicious content.
Capability inventory: The script has network access via urllib.request and can perform multiple rounds of automated searches.
Sanitization: Content is URL-encoded but not filtered for malicious instruction patterns, allowing crafted text in a LaTeX document to potentially influence search parameters or citation harvesting logic.
[EXTERNAL_DOWNLOADS]: The harvest_citations.py script makes network requests to the Semantic Scholar API (https://api.semanticscholar.org/graph/v1/paper/search). This is a legitimate connection to a well-known service for bibliographic data and does not escalate the verdict.

citation-management