The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-provided parameters directly into a Stata script template without sanitization. User inputs for "model command", "absorb", and "vce" are used to replace placeholders like "<<MODEL_CMD>>", "<<MODEL_ABSORB>>", and "<<MODEL_VCE>>" in the "template.do" file. The template subsequently uses these variables in execution contexts, such as "${model_cmd} $dependentVariable" and in constructing worker scripts via "file write". Because Stata scripts can execute shell commands or chain multiple Stata commands, a malicious user could provide input containing separators or shell escapes to execute unauthorized commands on the user's system when the script is run.

Significance-Search