The Agent Skills Directory

[DYNAMIC_EXECUTION]: The ScriptScorer class in scripts/scoring.py (lines 53-61) uses importlib.util to dynamically load and execute Python code from a file path at runtime. The path is resolved in scripts/aco.py (lines 191-201) based on the scoring.script_path value provided in the swarm-config.json configuration file. This allows for arbitrary code execution if an attacker can influence the configuration file and place a malicious script in the filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and processing structured data from sub-agents (ants).
Ingestion points: Ant artifacts (ant-*.json) are loaded by scripts/aco.py (line 166) and the analyst role (Phase 2). These files contain natural language fields like rationale, summary, and notes.
Boundary markers: The _validate_artifact function in scripts/aco.py (line 179) enforces schema and range validation (e.g., scores between 0 and 1), and role specifications instruct ants to self-validate.
Capability inventory: The skill has access to powerful tools including Bash, Agent (worker spawning), Write, and TeamCreate.
Sanitization: While numeric and structural validation is present, there is no explicit sanitization of natural language content that is eventually synthesized by the analyst role into the final best-solution.md report.
[COMMAND_EXECUTION]: The test suite scripts/test_aco.py (line 34) uses subprocess.run() to execute the aco.py script. While it uses a list of arguments rather than a shell string, it represents runtime command execution. Furthermore, the coordinator role frequently invokes the Python CLI scripts using the Bash tool to perform numeric calculations and state updates.

team-swarm