The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run the command python -m apps.agents.$ARGUMENTS.main. The $ARGUMENTS placeholder is directly interpolated into a shell command without programmatic validation or sanitization. This pattern is susceptible to command injection if the input contains shell metacharacters such as ;, &, or |.
Evidence: python -m apps.agents.$ARGUMENTS.main in SKILL.md.
[DYNAMIC_EXECUTION]: The skill uses runtime arguments to determine the specific Python module path to be executed. Constructing execution paths from external input is a security risk as it allows for the execution of arbitrary code within the apps.agents namespace or elsewhere if directory traversal is possible.
Evidence: The workflow determines the execution target dynamically via $ARGUMENTS.

run-agent