The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill implements a pluggable scoring mechanism that dynamically loads and executes Python code from paths specified in the configuration.
Evidence: scripts/scoring.py (lines 44-53) uses importlib.util to load a module from rule_path and executes it using exec_module. The path is derived from user-controlled configuration in swarm-config.json.
[DATA_EXFILTRATION]: The skill provides a mechanism for arbitrary file system discovery and exploration through configuration parameters.
Evidence: scripts/aco.py (lines 78-83) uses the auto_discover_from configuration value directly in a glob.glob call with recursive=True. This allows listing potentially sensitive files if the user provides an expansive glob pattern.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates untrusted user input into the system prompts of subagents.
Ingestion points: roles/coordinator/commands/iterate.md (Step 4) and roles/coordinator/role.md (Phase 3) show the Agent tool being called with prompts containing the requirement (user task description) without sanitization.
Boundary markers: The skill uses section headers (e.g., ## Assignment) but lacks robust delimiters or "ignore embedded instructions" warnings to prevent instructions in the user data from overriding subagent behavior.
Capability inventory: Subagents possess powerful capabilities including Bash command execution, file system writes (Write), and task management (TaskUpdate).
Sanitization: No sanitization or escaping of external content is performed before interpolation into subagent prompts.
[COMMAND_EXECUTION]: The skill uses shell command execution to drive its core logic and testing framework.
Evidence: The coordinator role frequently invokes aco.py via the Bash tool to perform numeric optimization tasks.
Evidence: scripts/test_aco.py uses subprocess.run to execute the CLI script during automated tests.

team-swarm