The Agent Skills Directory

[COMMAND_EXECUTION]: The LocalVerifier in verify_cascade.py executes a shell command specified by the MAGGY_JUDGE_CMD environment variable, defaulting to deepseek --flash.
Evidence: The skill uses subprocess.run(cmd, input=prompt, ...) in the _default_judge function to call the local model.
Safety Check: The implementation passes the model prompt via standard input (stdin) rather than command-line arguments, which mitigates traditional command injection risks from the prompt content itself.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it interpolates external, untrusted source text and extracted values directly into the prompt used by the judge model.
Ingestion points: The source_text provided in the state dictionary and the values within the record in verify_cascade.py.
Boundary markers: The prompt uses simple text headers like SOURCE: and QUESTIONS: to separate data, but lacks robust delimiters (like cryptographic markers) or sanitization to prevent data from being interpreted as instructions by the judge model.
Capability inventory: The result of the verification determines whether the system escalates to a more powerful model. An attacker could provide source text that instructs the judge to always return a low probability of error, effectively bypassing the verification gate.
Sanitization: No explicit escaping or filtering of the source text or extracted values is performed before prompt interpolation.
[EXTERNAL_DOWNLOADS]: The skill includes an optional TypeSafeVerifier that transmits data to an external service for processing.
Evidence: The TypeSafeVerifier.verify method makes network calls to api.typesafe.ai.
Context: This is a documented, opt-in feature requiring a TYPESAFE_API_KEY. When enabled, it sends the source_text, schema, and extraction to the third-party service, which constitutes a data exposure surface for sensitive content.

verify-cascade