The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/edit_csv.py script uses the exec() function to execute Python code provided via command-line arguments. This allows for arbitrary command execution on the system where the script is invoked.
[REMOTE_CODE_EXECUTION]: The skill's documentation explicitly promotes a workflow where the agent executes Python code received from an LLM. This introduces a vulnerability where a malicious or manipulated AI could cause the execution of harmful code in the local environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes external CSV files and incorporates their content into LLM prompts using the templates in assets/llm-prompt-template.md. An attacker could embed instructions within a CSV file to influence the AI's output.
Ingestion points: Untrusted CSV data is read through scripts/csv_to_toon.py and scripts/edit_csv.py.
Boundary markers: Data is delimited by markdown code blocks in the prompt templates, but there are no instructions for the model to ignore potential commands within that data.
Capability inventory: The skill has the capability to execute arbitrary Python code via scripts/edit_csv.py and perform file system operations.
Sanitization: There is no evidence of sanitization for the CSV data before it is sent to the LLM, nor for the LLM-generated code before it is executed.

csv-llm-edit