The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a script execute-code.sh that allows the agent to run arbitrary Python code within a marimo notebook's kernel. This is a core feature but constitutes high-privilege execution within the notebook environment.
[EXTERNAL_DOWNLOADS]: The execute-code.sh script allows the agent to connect to remote server URLs via the --url flag. The instructions correctly warn that connecting to non-local servers could lead to data exfiltration or interaction with malicious endpoints.
[CREDENTIALS_UNSAFE]: Authentication tokens for marimo servers can be passed via the --token command-line argument. This is insecure as it exposes the secret in the system's process list (e.g., via ps), although the script also supports the safer MARIMO_TOKEN environment variable.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. The agent reads and processes output from the notebook kernel; if a notebook contains attacker-controlled data or malicious instructions, it could influence the agent's behavior during the session.

marimo-pair