The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses a high-risk execution pattern to install the uv package manager by fetching a shell script from https://astral.sh/uv/install.sh and piping it directly to sh in SKILL.md.
[DYNAMIC_EXECUTION]: The scripts/benchmark.py script dynamically loads and executes code from a benchmark_spec.py file found in the same directory as the target file using importlib.util.exec_module. This mechanism can be exploited to execute arbitrary Python code if a malicious spec file is placed in the workspace.
[COMMAND_EXECUTION]: The skill invokes several command-line tools (ruff, ty, pytest, radon) via the subprocess module.
The file evals/fixtures/subprocess_safety/runner.py contains subprocess.run calls with shell=True, which increases the risk of command injection.
The tool scripts pass user-controlled file paths to these binaries, which may lead to unexpected behavior if paths are not properly validated by the underlying shell.
[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary Python source code to perform optimization and error fixing. It lacks sufficient boundary markers or sanitization to prevent the agent from following instructions embedded within the analyzed code's comments or strings.
Ingestion points: Python source code files provided as the TARGET_FILE argument.
Boundary markers: No explicit delimiters are used when passing the file content or analysis results to the agent's context.
Capability inventory: The agent has the ability to write to the file system, execute shell commands (via linters and test runners), and perform git operations.
Sanitization: No sanitization is performed on the ingested code before it is analyzed by the agent.

python-autotuner