The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates Python and R analysis scripts based on extracted methodology and then executes them, creating a risk if the generation process is compromised.
The SKILL.md file (Phase 3) instructions the agent to generate comprehensive analysis code, including data cleaning and statistical modeling using pandas and subprocess calls to R.
The skill.yml manifest explicitly declares executes_analysis_code as a side effect of the skill's operation.
The agent utilizes the Bash tool to perform operations, providing a powerful environment for executing these generated scripts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data which could contain malicious instructions designed to alter the generated analysis code.
Ingestion points: Untrusted data enters the agent's context through source papers (PDF/Markdown) and target database files (CSV/SAS) during Phase 1 and Phase 2 of the workflow in SKILL.md.
Boundary markers: No explicit delimiters or boundary markers are defined to isolate untrusted content from the code generation prompt logic.
Capability inventory: The skill possesses capabilities to write files (Write), edit content (Edit), and execute shell commands (Bash), which can be leveraged if an injection occurs.
Sanitization: There is no evidence of sanitization or validation of extracted concepts or variable names before they are interpolated into the Python and R code templates.

replicate-study