The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions in SKILL.md and references/usage.md explicitly direct the agent to request the server's IP address, username, and password from the user. Handling raw credentials in plain-text prompts is a high-risk practice that exposes sensitive access information to the AI model and session logs.
[REMOTE_CODE_EXECUTION]: The skill allows the user to provide their own Python scripts for benchmarking (demo 方案: 我提供). The agent is instructed to prioritize and execute this user-supplied code on the target server. There is no evidence of sanitization, static analysis, or sandboxing of this code before execution, allowing for arbitrary code execution on the server.
[COMMAND_EXECUTION]: The skill executes several shell scripts and system commands on the target environment. Specifically, scripts/find_docker_cann.sh uses docker exec with shell-interpreted strings, and scripts/bench_repeat_interleave.py uses subprocess.call to pass command-line arguments. While these are part of the benchmark functionality, they provide a path for command injection if input parameters are not strictly validated.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input, such as environment names and demo code, which are then interpolated into execution commands. The mandatory evidence chain is as follows:
Ingestion points: User-provided demo code and environment names in SKILL.md and references/usage.md.
Boundary markers: None identified; there are no instructions to the agent to treat user-provided code as untrusted data or to wrap it in specific delimiters.
Capability inventory: The skill uses subprocess.call (in scripts/bench_repeat_interleave.py) and docker exec (in scripts/find_docker_cann.sh) to execute logic on the server.
Sanitization: None identified; the skill relies on the agent to "design the demo" or "use the provided demo" without validation logic.

npu-op-benchmark