The Agent Skills Directory

[SAFE]: The skill provides documentation for worker lifecycle management (spawn, prompt, poll, stop) using environment variables for configuration and authentication, which is a standard and secure practice for managing sensitive tokens like PYLOT_DISPATCH_TOKEN.
[COMMAND_EXECUTION]: The shell snippets utilize python3 -c to parse JSON data from API responses. This is a local data processing pattern and does not involve dynamic execution of untrusted code.
[DATA_EXFILTRATION]: The skill performs network requests via curl to interact with a worker gateway API defined by the $PYLOT_API environment variable. These operations are consistent with the skill's primary purpose of driving remote worker infrastructure.
[SAFE]: Evaluation of potential indirect prompt injection surface identifies that while the skill passes a $PROMPT variable to remote workers, it functions as a baseline template for other skills.
Ingestion points: The $PROMPT variable in SKILL.md snippets.
Boundary markers: None explicitly defined in the provided snippets.
Capability inventory: Network access via curl and local data processing via python3.
Sanitization: No explicit sanitization of the $PROMPT variable is performed in these lifecycle templates.
[SAFE]: No obfuscation, persistence mechanisms, or unauthorized privilege escalation patterns were detected.

pylot-workers