The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the swanlab Python package from the public PyPI registry using pip install. The package version is not pinned, which can lead to environment drift or exposure to supply chain attacks if a malicious version is uploaded to the registry.
[COMMAND_EXECUTION]: The skill uses docker exec to run shell commands inside containers and executes various shell scripts on the host to manage configurations and login states.
[INDIRECT_PROMPT_INJECTION]: The swanlab_setup_for_container function in scripts/functions.sh is vulnerable to command injection. It interpolates variables directly into a shell string executed via docker exec. If the SWANLAB_API_KEY or SWANLAB_HOST variables contain single quotes (e.g., '; touch /tmp/pwned; '), they can break out of the intended command and execute arbitrary code inside the container.
Ingestion points: SWANLAB_API_KEY and SWANLAB_HOST are ingested from environment variables, ~/.verl/swanlab.conf, or interactive user input.
Boundary markers: None. The variables are wrapped in single quotes within a double-quoted bash string, which is insufficient for sanitization.
Capability inventory: Uses docker exec, pip install, and bash command execution.
Sanitization: No escaping or validation is performed on the host or key variables before they are passed to the shell.
[CREDENTIALS_UNSAFE]: The skill stores the SwanLab API key in plain text within ~/.verl/swanlab.conf. While the script attempts to restrict access using chmod 600, storing secrets in plain text on the file system remains a risk factor.

swanlab-setup