The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's core documentation in SKILL.md and USAGE.md lists 'Python pickle' as a supported data format for analysis. The use of the Python pickle module for deserializing data is inherently insecure because it allows for the execution of arbitrary code during the loading process. A maliciously crafted pickle file provided as experimental data could execute commands on the agent's host environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize data from various external file formats, which represents a potential injection surface.
Ingestion points: Experimental data files in CSV, JSON, TensorBoard, and Pickle formats are loaded and processed via the /analyze-results command, as described in SKILL.md and USAGE.md.
Boundary markers: The skill does not provide specific instructions or delimiters to the agent to distinguish between the data content and the analysis instructions, potentially allowing data content to be interpreted as commands.
Capability inventory: The workflow includes script execution for statistical analysis and visualization generation using libraries such as matplotlib and seaborn.
Sanitization: No data validation, filtering, or sanitization steps are defined to protect the agent from processing malicious instructions embedded within the results data.
[EXTERNAL_DOWNLOADS]: The skill references and provides links to external reporting guidelines and checklists from well-known academic and scientific organizations.
Evidence: Links to the Nature Statistics Checklist, Science Reproducibility Guidelines, and the NeurIPS Paper Checklist are provided in SKILL.md for user reference.

results-analysis