The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary commands provided by the agent through the run subcommand. It uses subprocess.Popen with shell=False to mitigate command injection risks and requires the agent to wrap only authorized verification commands. This capability is central to the skill's purpose as a benchmarking tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured JSON data from external unloop core journals and manual receipts provided via stdin. This ingestion surface could potentially be used to introduce malicious instructions, although the risk is mitigated by schema validation and the fact that reporting does not involve model-based interpretation.
Ingestion points: Data enters the system through sys.stdin for receipts and a local registry.json file for core store synchronization.
Boundary markers: The system utilizes structured JSON and explicit schema definitions to delimit data.
Capability inventory: The skill performs local file system writes to a database and artifact directory, and executes shell commands via subprocess.Popen in scripts/benchmarklib/capture.py.
Sanitization: The skill validates input schemas, performs symlink checks to prevent directory traversal, and escapes special characters in CSV exports to prevent spreadsheet formula injection attacks.

unloop-bench