The Agent Skills Directory

[COMMAND_EXECUTION]: Several Python helper scripts (upload_attachment.py, aitable_export_via_task.py, import_records.py, bulk_add_fields.py) utilize subprocess.run() to execute the dws CLI tool. While some inputs are validated, this pattern introduces a risk of command injection if the agent is manipulated or if validation regex is bypassed.
[DYNAMIC_EXECUTION]: The script scripts/aitable_import_via_task.py employs os.execvp() to perform process replacement, a high-risk execution pattern that replaces the current process with a new one.
[DATA_EXFILTRATION]: The script scripts/upload_attachment.py reads local file content and performs a network upload (HTTP PUT) to a dynamically provided URL. Notably, this script lacks the resolve_safe_path check found in other scripts in the same package, potentially allowing the agent to read and exfiltrate sensitive files from the local filesystem if instructed.
[EXTERNAL_DOWNLOADS]: The script scripts/aitable_export_via_task.py includes a function to download files from a remote URL and write them to a local path. Like the upload script, it lacks sufficient path validation for the output file destination.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from AI Tables, records, comments, and external files (CSV/Excel), creating a large surface for indirect prompt injection.
Ingestion points: Ingestion occurs via aitable record query, aitable psql, comment list, and file import commands.
Capability inventory: The skill has broad capabilities including file read/write, network upload/download, and system command execution.
Boundary markers: The instructions mention distinguishing between local contract review and remote status but lack robust delimiters for untrusted data processing.
Sanitization: Some scripts use resolve_safe_path, but others like upload_attachment.py omit these checks, leaving a gap in the defense-in-depth posture.

dingtalk-aitable