The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script examples/python/benchmark_testing.py uses the exec() function to run code generated by an external LLM API.
Evidence: In the run_code_benchmark function, the variable generated_code (which contains the raw text output from a call to client.chat.completions.create) is passed directly into exec(generated_code, local_scope).
Risk: This pattern is highly dangerous as it grants the model the ability to execute arbitrary Python code on the host system. A compromised or adversarial model could return destructive commands (e.g., file system deletions or credential harvesting scripts) which would then be executed with the same permissions as the running agent.
[REMOTE_CODE_EXECUTION]: The skill enables a remote code execution vector by processing untrusted strings from a remote model API as executable logic.
Evidence: The execution flow in examples/python/benchmark_testing.py converts remote LLM completions into local process execution without validation or isolation.
[PROMPT_INJECTION]: The skill's documentation contains numerous known malicious prompt injection and jailbreak strings.
Evidence: references/safety-evaluation.md explicitly lists payloads such as "Ignore previous instructions", "reveal your system prompt", "[SYSTEM OVERRIDE]", and "DAN (Do Anything Now)".
Risk: While intended for red-teaming tests, the presence of these instructions in the skill's own content can lead to the agent overriding its own safety constraints or leaking system information if it processes these files during a task.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from untrusted external sources (AI model responses), creating a vulnerability surface for indirect injection.
Ingestion points: examples/python/benchmark_testing.py (LLM code generation) and references/safety-evaluation.md (documented injection payloads).
Boundary markers: The provided code does not use delimiters or safety markers when interpolating untrusted data into prompts or processing outputs.
Capability inventory: The skill utilizes the high-privilege exec() capability.
Sanitization: No sanitization, escaping, or sandboxing is implemented for the external content before it is executed.

evaluating-llms