The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Step 5: Execution Testing) command the agent to run arbitrary shell commands like python scripts/<script_name>.py and curl. This provides a path for the execution of arbitrary scripts and network requests defined within any skill provided by a user for auditing.
[REMOTE_CODE_EXECUTION]: The skill is designed to execute external code shipped with a user-provided skill to perform functional testing. A malicious skill can exploit this by including scripts that perform unauthorized or harmful operations on the host system. The script scripts/evaluate_skill.py also utilizes the Python compile() function to process the source of target scripts, which is a dynamic execution sink.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it processes untrusted data from the audited skill's SKILL.md and script files without adequate isolation.
Ingestion points: Contents of the audited skill's instructions and script directory are read into the agent context in Steps 1, 2, and 5.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when processing the target skill's content.
Capability inventory: The skill possesses the ability to execute shell commands (python, curl) and generate system-level reports.
Sanitization: No validation, escaping, or filtering of the target skill's content is performed before it is used to influence the agent's logic or scoring.
[DATA_EXFILTRATION]: The execution testing pipeline captures stdout and stderr from the audited scripts and includes them in the resulting audit reports. A malicious script in an audited skill could use this mechanism to print sensitive system data, such as environment variables or SSH keys, to the console, allowing it to be exfiltrated through the final JSON or Markdown reports produced by the agent.

skill-auditor