The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions in SKILL.md direct the agent to execute Python scripts located at telemetry/version_check.py and telemetry/telemetry_init.py. These files are not included in the skill payload. Instructing an agent to execute unverified external scripts from the host environment is a security risk as the behavior of these scripts cannot be audited.
[COMMAND_EXECUTION]: The skill frequently uses shell execution (python3) to run both the included scripts/evaluate_slate.py and the missing telemetry scripts. This reliance on shell commands increases the risk of command injection if parameters are not strictly controlled.
[DATA_EXFILTRATION]: The skill initializes telemetry (telemetry_init.py) at startup. Although the documentation claims this is "privacy-preserving," the lack of source code for the telemetry script makes it impossible to verify if sensitive information, such as project paths or analytics data, is being exfiltrated to a remote server.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it is designed to ingest and analyze untrusted project data.
Ingestion points: SKILL.md instructs the agent to "Inspect only supplied or authorized builds, repositories, demos, agent runs, dashboards, analytics, and workflow outputs."
Boundary markers: Absent. The skill does not specify delimiters or provide instructions to the LLM to ignore potentially malicious commands embedded within the ingested files.
Capability inventory: The agent has the capability to write files (--output slate-eval.json) and execute shell commands (python3), which could be leveraged if an injection is successful.
Sanitization: None. The skill does not outline any steps for filtering or sanitizing the content retrieved from external builds or dashboards.

show-and-tell-video-slate