The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script test_kernel.py uses exec() to evaluate Python code snippets extracted from generated prompt strings using regular expressions. This practice allows for the execution of dynamically constructed code that incorporates external inputs, posing a risk if the generation logic or the input data is compromised.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted inputs, such as user-defined claims and panel descriptions, and interpolates them into instructions for sub-agents without sufficient isolation or sanitization.\n
Ingestion points: The claim and dataVersionIds inputs in SKILL.md, and the message and ask fields in the panel outline generated and used by kernel.py.\n
Boundary markers: External content is placed inside markdown blockquotes (> ) within the prompts for sub-agents, which provides only minimal protection against malicious instructions embedded in the data.\n
Capability inventory: The skill and its delegated sub-agents have the ability to execute code in a Python kernel (notebook_execute), manage project artifacts, and write files to the system via write_artifact_file.\n
Sanitization: There is no evidence of escaping or sanitizing the strings provided by the user or external data sources before they are included in the prompt templates.\n- [COMMAND_EXECUTION]: The skill utilizes notebook_execute and repl_execute to perform its core functions, enabling the execution of arbitrary Python code in the kernel and the management of sub-agent processes.

figure-composer