The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill's setup instructions in the README.md recommend the use of sudo apt install for installing system dependencies such as ros-humble-robot-localization and libgtsam-dev. Providing an agent with Bash(*) capabilities and instructions to use sudo allows for administrative privilege escalation within the execution environment.\n- [EXTERNAL_DOWNLOADS]: The skill documentation references third-party resources that are not part of the established trusted vendor or well-known services list, including a personal GitHub repository for EKF implementation (github.com/balamuruganky/EKF_IMU_GPS) and a third-party MCP server (github.com/robotmcp/ros-mcp-server). These references point the agent toward unverifiable external code sources.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data files, creating a vulnerability surface for indirect prompt injection.\n
Ingestion points: The skill reads from external data files such as imu_log.csv and test.db3 via the tune-noise and analyze commands.\n
Boundary markers: There are no specified delimiters or instructions to the agent to ignore any natural language instructions that might be embedded within these data files.\n
Capability inventory: The skill possesses a broad set of tools including Bash(*), Write, Edit, and WebFetch, which could be abused if malicious instructions in a data file are successfully processed by the agent.\n
Sanitization: No evidence of input validation, sanitization, or schema enforcement is provided for the contents of the ingested log or bag files.

sensor-fusion