The Agent Skills Directory

[COMMAND_EXECUTION]: The GitHub Actions workflow template (.github/workflows/model-promotion.yaml) in SKILL.md is vulnerable to shell command injection through the interpolation of workflow_dispatch inputs.
The inputs model_name and model_version are used directly within shell run blocks (e.g., python -m evals.run --model "${{ inputs.model_name }}:${{ inputs.model_version }}").
An attacker with permissions to trigger the workflow could provide malicious inputs (e.g., model\"; malicious_command #) to execute arbitrary code within the GitHub Actions runner context.
This pattern is repeated in multiple jobs including evaluate, deploy, and promote.
[INDIRECT_PROMPT_INJECTION]: The skill defines a platform architecture that processes untrusted external inputs to drive sensitive deployment capabilities without sufficient sanitization boundaries.
Ingestion points: model_name and model_version workflow inputs in SKILL.md.
Boundary markers: Absent. The inputs are directly interpolated into commands.
Capability inventory: The workflow is capable of executing shell scripts, running evaluation suites, and modifying Kubernetes deployments via kubectl.
Sanitization: No sanitization or validation logic is present to ensure inputs conform to expected model naming conventions before they are processed by the platform's automation.

llmops-platform-engineering