The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/dispatch.py retrieves sensitive credentials, specifically RUNPOD_API_KEY and REMOTE_COMPUTE_API_KEY, from environment variables. These keys are included in the Authorization header of outgoing HTTP requests. Since the destination URL is provided as a command-line argument (--endpoint) that can be influenced by user prompts, there is a possibility that these credentials could be exfiltrated to an untrusted external server if an attacker-controlled URL is supplied.
[COMMAND_EXECUTION]: The skill invokes system binaries including sbatch, sacct, and scancel using subprocess.run in scripts/dispatch.py. While the implementation passes arguments as a list to avoid shell injection, it still grants the agent the capability to perform local system management operations based on job specifications which may be derived from untrusted input.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and parses JSON data from remote REST endpoints, which constitutes a potential injection surface.
Ingestion points: External data enters the agent context via the rest_request function in scripts/dispatch.py when it fetches and decodes remote API responses.
Boundary markers: There are no explicit markers or instructions to treat these external responses as untrusted data within the processing logic.
Capability inventory: The skill maintains capabilities for local command execution (subprocess.run) and network requests (urllib.request).
Sanitization: The script does not perform validation or sanitization on the data retrieved from the remote JSON responses before using it to define job status and returning it to the agent environment.

alterlab-remote-compute