The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches external content from sources including ArXiv, GitHub, and Hugging Face. It use tools like wget, curl, and aria2c to download datasets from URLs specified in papers or repositories.
[REMOTE_CODE_EXECUTION]: The workflow clones external repositories via git clone and executes the contained code using python train.py. This pattern allows for the execution of arbitrary code from untrusted external sources.
[COMMAND_EXECUTION]: The skill frequently invokes shell commands such as gh, git, uv, and python to manage dependencies and execute workloads. This provides a broad surface for command-related risks if inputs are not properly handled.
[DYNAMIC_EXECUTION]: In Stage 4 and Stage 6, the agent is directed to write Python scripts such as train.py and smoke_forward.py based on its analysis of the paper and then execute those scripts to verify implementation. This involves runtime assembly and execution of code.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data extracted from external papers and code repositories, creating a risk that malicious instructions hidden in these sources could influence the agent's behavior.
Ingestion points: Arxiv HTML extracted via Tavily and code repositories cloned via Git as seen in references/01-paper-fetch.md and references/02-code-clone.md.
Boundary markers: Content is organized into structured markdown files, but there are no explicit safety instructions to ignore potential injection markers within the extracted text.
Capability inventory: File system access, network downloads, package installation, and arbitrary Python code execution.
Sanitization: Content is copied verbatim into local extracts without filtering for malicious prompt patterns.

reproduce