The Agent Skills Directory

[DYNAMIC_EXECUTION]: The file examples/reward_functions_library.py contains a run_test_cases function that utilizes the exec() built-in to execute code blocks extracted from model-generated completions. This allows for the execution of arbitrary Python code within the host environment. While the code includes a comment warning that sandboxing should be used in production, the provided implementation lacks any safety boundaries.
[INDIRECT_PROMPT_INJECTION]: The skill is architected to ingest external data and use it to prompt a model whose output is then executed, creating a significant vulnerability surface.
Ingestion points: Untrusted data enters the agent context through the get_dataset function in templates/basic_grpo_training.py (which fetches the GSM8K dataset from OpenAI's Hugging Face repository) and custom loaders in SKILL.md.
Boundary markers: The instructions recommend using XML-like tags (e.g., <reasoning>, <answer>) to delimit model output, but these do not prevent the model from generating malicious code within those tags.
Capability inventory: The skill provides the exec() capability through the code_execution_reward implementation in examples/reward_functions_library.py.
Sanitization: There is no sanitization, filtering, or restricted environment (sandbox) applied to the code extracted from model completions before execution.

grpo-rl-training