The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents functions (FastAPI endpoints, scrapers) that ingest external data, creating a potential surface for indirect injection if data is processed by an LLM without adequate protection.
Ingestion points: Data ingestion occurs in code examples for scrape_url, api(request), and embed(request) within references/examples.md.
Boundary markers: The provided templates do not include specific prompt delimiters or instructions to ignore embedded commands.
Capability inventory: The platform offers subprocess.run, subprocess.Popen, and modal.Sandbox.exec capabilities for executing code in containers.
Sanitization: The skill includes clear security warnings in SKILL.md and reference files, advising the use of modal.Sandbox for untrusted code and recommending hardcoded argument lists to prevent command injection.
[COMMAND_EXECUTION]: The skill utilizes shell commands and subprocess calls for platform features and specialized task launchers.
Evidence: references/gpu.md and references/web-endpoints.md demonstrate using subprocess.run and subprocess.Popen for tools like Hugging Face Accelerate, vLLM, and PyTorch training scripts.
[EXTERNAL_DOWNLOADS]: The skill fetches container images, Python packages, and model weights from well-known registries and trusted services.
Evidence: Fetches Python packages from PyPI using uv, pulls container base images from Docker Hub, and retrieves model weights from Hugging Face repositories.
[DYNAMIC_EXECUTION]: The skill provides features for dynamic code execution as part of its core serverless functionality.
Evidence: SKILL.md and references/api_reference.md document run_function for executing Python code during image builds and modal.Sandbox for programmatically executing dynamically generated code in isolated environments.

modal