The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple scripts within the skill utilize subprocess.run to execute external command-line tools for code analysis.
scripts/analyze_multi_metrics.py executes complexipy and radon to collect complexity metrics.
scripts/analyze_with_flake8.py executes flake8 to perform linting.
These calls use string interpolation for file paths, which could be exploited for command injection if the agent is directed to process maliciously named files.
[REMOTE_CODE_EXECUTION]: The script scripts/benchmark_changes.py performs dynamic code execution by loading local Python modules using importlib.util.spec_from_file_location and spec.loader.exec_module.
This is used to load both the 'before' and 'after' versions of the code to run performance comparisons.
This behavior results in the execution of any code contained within the files being refactored, posing a significant risk if those files contain malicious payloads.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data in the form of local Python source code.
Ingestion points: Several scripts (analyze_multi_metrics.py, benchmark_changes.py, measure_complexity.py) read and parse Python files provided by the user/agent.
Boundary markers: None. The scripts treat the file content as standard source code without special delimiters to prevent instruction injection.
Capability inventory: The skill has access to shell command execution (subprocess.run) and dynamic Python execution (importlib).
Sanitization: There is no evidence of sanitization for file paths passed to shell commands or for the content executed during benchmarking.
This combination creates a surface where maliciously crafted source code could attempt to influence the agent's behavior or exploit the dynamic execution capabilities.

python-refactor