The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically loads and executes user-provided Python modules for model evaluation and training. In scripts/modules/train.py, the functions load_rollout_function and load_grader_function utilize __import__() and spec.loader.exec_module() to execute code from paths provided as CLI arguments. This pattern allows for the execution of arbitrary Python code within the agent's environment.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md frequently direct the agent to execute shell commands to manage training jobs, initialize workspaces, and run helper scripts. This reliance on shell execution increases the risk of command injection if user-provided inputs are not properly sanitized before being passed to sub-processes.
[PRIVILEGE_ESCALATION]: SKILL.md contains a mandatory step to "Fix FaaS permissions" using find . -type d -exec chmod 755 {} \; and find . -type f -name "*.py" -exec chmod 644 {} \;. While these are standard permissions, the automated modification of file system permissions across the workspace is a sensitive operation that could be abused to change access controls on critical files.
[INDIRECT_PROMPT_INJECTION]: The skill processes external datasets (JSONL format) and user-provided code (rollout and grader scripts). This ingestion of untrusted content creates a significant surface for indirect prompt injection, where malicious instructions embedded in the data could influence the agent's behavior during the training or evaluation cycles.
[PROMPT_INJECTION]: The SKILL.md file contains strong override instructions such as "This SKILL's all flow requirements have the highest priority, higher than any general reasoning logic" and "All steps must be strictly executed in order, jumping, adjusting order, or self-play is strictly prohibited." These are classic markers used to attempt to bypass the AI's internal safety guardrails or default operational logic.

byted-ark-trainer