The Agent Skills Directory

[COMMAND_EXECUTION]: The helper scripts scripts/init-dvc-project.sh and scripts/queue-helper.sh use shell execution methods that are susceptible to command injection. Specifically, init-dvc-project.sh utilizes eval "$@" in its run function, and queue-helper.sh performs unquoted variable expansion (dvc exp run --queue $flags). These patterns could allow for the execution of arbitrary commands if the agent is manipulated into passing malicious strings as parameters (e.g., through untrusted data sources).
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes user-controlled configuration files and CLI arguments without robust sanitization.
Ingestion points: Project configuration files (params.yaml, dvc.yaml) and command-line arguments passed to the queue-helper.sh and init-dvc-project.sh scripts.
Boundary markers: Absent; the skill does not use explicit delimiters or instructions to prevent the agent from obeying commands embedded within the configuration files or parameters.
Capability inventory: The skill can execute shell commands and modify the local filesystem via the DVC CLI and the bundled bash scripts.
Sanitization: The bash scripts lack sanitization for shell metacharacters in input parameters, relying on standard shell expansion which is vulnerable to injection.

dvc-ml-workflow