The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requests shell:exec permissions to perform its tasks. It uses subprocess.run to execute the latexmk system utility for PDF generation. This behavior is expected for its primary purpose but grants the agent the ability to run external binaries.
[DATA_EXPOSURE]: The tools read_reference and scan_template in scripts/writer_tools.py provide read access to the local file system. This allows the agent to ingest the contents of provided files (including .docx, .txt, and .tex) into its processing context.
[PRIVILEGE_ESCALATION]: The setup instructions in SKILL.md require the user to run sudo commands to install the LaTeX distribution (texlive-full) and compilation tools. While standard for environment setup, this involves high-privilege system modifications.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad vulnerability surface for indirect prompt injection via untrusted data ingestion.
Ingestion points: The read_reference function in scripts/writer_tools.py reads content from user-provided files (e.g., notes or draft documents), and scan_template reads the headers of LaTeX files in the directory.
Boundary markers: No markers or delimiters are used to separate external content from the agent's instructions.
Capability inventory: The skill has file-writing capabilities (write_latex_content) and command execution capabilities (compile_pdf invoking latexmk).
Sanitization: There is no evidence of sanitization or filtering of the content read from files before it is passed back to the LLM context, allowing potentially malicious instructions embedded in documents to influence agent behavior.

academic-writer