The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions in references/onboarding.md to install the 'Hunk' tool using a curl -fsSL https://hunk.dev/install.sh | sh pipe. This represents a high-risk remote execution pattern from an unverified source, which an agent might execute directly if tasked with environment setup.
[COMMAND_EXECUTION]: The resolve_bench_config.py script allows an untrusted repository to define arbitrary commands in a .bench/config.toml file. The skill instructions in SKILL.md then direct the agent to execute these commands via a UI adapter, enabling arbitrary code execution on the host machine by a malicious repository.
[PRIVILEGE_ESCALATION]: SKILL.md explicitly instructs the agent to run mise trust on any mise.toml file found in a new bench workspace. This action authorizes the execution of arbitrary shell hooks and scripts defined by the repository, bypassing the safety prompts typically required for environment configuration tools.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection.
Ingestion points: PR metadata, ticket metadata, and repository-provided configuration files (.bench/config.toml, mise.toml).
Boundary markers: The skill uses basic prompt prefixes like 'Read {brief}, then plan before edits' but lacks rigorous sanitization or escaping of the ingested content.
Capability inventory: The agent has the ability to execute VCS commands, manage terminal sessions via zmx and supacode, and run arbitrary commands defined in the workspace configuration via subprocess.run.
Sanitization: While the Python scripts use shlex to safely handle command-line arguments, there is no evidence of sanitization for the natural language content provided to the harness agents, allowing malicious instructions in PRs or tickets to potentially influence agent behavior.
[EXTERNAL_DOWNLOADS]: The skill references and recommends downloading software from unverified third-party sources like hunk.dev and GitHub repositories such as rockorager/comview, which are not part of the recognized trusted vendor infrastructure.

bench