The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/validate_task.py employs the exec() function to run the generated operator task file. This file is directly derived from user-supplied source code. The execution of untrusted code at runtime is a high-risk operation that can lead to full system compromise.
[REMOTE_CODE_EXECUTION]: The extraction workflow takes user-controlled file paths as input and executes the contents through the validation script. An attacker providing a crafted Python file can achieve remote code execution (RCE) within the agent's execution environment.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md (Step 4) mandate the use of the bash tool to execute a shell command (python3 <skill-path>/scripts/validate_task.py ...) which subsequently triggers the dynamic execution of the user's code.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted code from external files without sanitization.
Ingestion points: User-provided source code files are read in Step 1 of the extraction process.
Boundary markers: None identified; there are no delimiters or warnings to the LLM to ignore instructions embedded in the input code.
Capability inventory: The skill utilizes exec() in scripts/validate_task.py and spawns subprocesses to run the validation script as defined in SKILL.md.
Sanitization: No filtering, escaping, or validation of the logic within the user-provided code is performed beyond a basic AST structure check.

external-cannbot-ops-triton-task-extractor