The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires cloning the core framework from an untrusted GitHub repository at https://github.com/capgym/cap-x.git. This external code is not from a well-known service or trusted organization and serves as the foundation for the skill's operations.
[DYNAMIC_EXECUTION]: The skill's primary architecture, 'Code as Policy', involves the LLM generating Python code that is directly executed on the host system to control robotic hardware. As documented in references/api-spec.md, the env.step(code) function compiles and executes arbitrary generated strings, creating a high-risk surface for command execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes perception data (e.g., scene descriptions and object masks) to influence the generation of executable Python code. This creates a vulnerability surface where adversarial inputs in the physical or simulated environment could lead to the generation and execution of malicious code.
Ingestion points: Visual observations (obs) and perception microservice outputs (SAM3, Molmo) processed in env.step().
Boundary markers: No explicit instruction delimiters or boundary markers are present to prevent the agent from obeying instructions embedded in environment data.
Capability inventory: Full Python execution capability via the Gymnasium environment wrapper, shell script execution for background services, and network access for microservices.
Sanitization: No evidence of code sanitization or safety sandboxing for the generated Python scripts before execution.
[METADATA_POISONING]: The skill's documentation (README.md and SKILL.md) references a research paper with a future-dated identifier (arXiv:2603.22435), which indicates the use of hallucinated or deceptive metadata to establish false authority.
[COMMAND_EXECUTION]: The skill includes shell scripts (scripts/setup-perception.sh and scripts/run-benchmark.sh) that launch multiple persistent background processes, manage PIDs, and perform system-level CUDA checks, increasing the operational risk for the host environment.

capx-agentic-robotics