The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/figure_spec.py implements an unsafe deserialization pattern using the Python pickle module.
Evidence: Line 116 in scripts/figure_spec.py contains the call fig = pickle.load(f), which loads data from a file path provided by the user via the --pickle command-line argument.
Risk: The Python pickle module is inherently insecure as it can execute arbitrary Python code during the unpacking process. This vulnerability allows an attacker to achieve Remote Code Execution (RCE) by providing a malicious pickle file for the skill to process during its 'Lint flow' as described in SKILL.md.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection via its visualization review functionality.
Ingestion points: The skill processes untrusted textual descriptions of figures through the style_lint.py --describe command and reads external figure files for analysis.
Boundary markers: There are no explicit delimiters or instructions to the agent to disregard potentially malicious directions embedded within the ingested figure metadata or descriptions.
Capability inventory: The skill has the ability to execute local Python scripts and interact with the filesystem, which could be abused if the agent is manipulated by injected instructions.
Sanitization: While basic regex checks are performed on input in scripts/style_lint.py, they do not provide protection against sophisticated prompt injection attacks designed to influence agent behavior.

plotting-advisor