The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/report_builder.py contains a mechanism to dynamically install the markdown package at runtime using os.system(f"{sys.executable} -m pip install markdown -q"). This allows for the execution of shell commands to modify the environment and fetch external code from PyPI, which could be exploited if the package name or environment variables are manipulated.\n- [COMMAND_EXECUTION]: The skill instructions in SKILL.md require the agent to execute a script at calculator/scripts/dasha_query.py. This script is not included in the provided skill files, indicating reliance on external executables that exist outside the verified scope of the skill folder.\n- [EXTERNAL_DOWNLOADS]: The report_builder.py script initiates an automated download and installation of the markdown library from the Python Package Index (PyPI). This bypasses the static review of the skill's code and introduces a dependency on external third-party infrastructure.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from structured_data.md (astrological data) and user_context.md (user biography) while possessing the ability to write files and execute scripts. This creates a surface for indirect prompt injection.\n
Ingestion points: The agent reads and interprets structured_data.md and user_context.md to generate reports.\n
Boundary markers: While the instructions include a 'Blind Audit' rule (盲审原则) to logically separate context, there are no technical delimiters (like XML tags or markers) used to encapsulate and isolate the untrusted input data.\n
Capability inventory: The agent has the capability to write multiple files (p1_overview.md, p2a_planets.md, etc.) and execute shell scripts (dasha_query.py, report_builder.py).\n
Sanitization: There is no evidence of input validation or sanitization of the content found in the external markdown data files before they are processed by the agent.

vedic-core