The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary setup commands on the host system. In scripts/runner.py, the _setup_sandbox function iterates through scenario.setup_commands and executes each via subprocess.run(parts, cwd=sandbox_dir). These commands originate from LLM output in scripts/scenario_generator.py which is prompted with the content of the skill file being analyzed.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection when analyzing untrusted markdown files. Ingestion points: The skill reads the content of the target file in scripts/spec_generator.py and scripts/scenario_generator.py. Boundary markers: Absent. The skill content is interpolated directly into prompts without delimiters or instructions to the LLM to treat the content as data rather than instructions. Capability inventory: The skill uses subprocess.run to call claude (which has access to tools like Bash, Write, Read, Edit) and to execute setup_commands. Sanitization: Absent. No escaping or filtering is applied to the input file content before interpolation.
[REMOTE_CODE_EXECUTION]: The execution of LLM-generated setup_commands allows for the potential download and execution of arbitrary code from remote sources, as these commands are not restricted to a safe whitelist.

skill-comply