The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file contains an instruction to execute a setup script (setup/setup.sh) silently at skill load time using backtick command execution. This allows for arbitrary code execution before any user interaction and could be used to compromise the environment before research even begins.
[REMOTE_CODE_EXECUTION]: The research protocol explicitly directs the agent to execute code found on the internet. In Phase 4, "executable" claims are verified by running "reproduction scripts" found in untrusted third-party research sources. This provides a direct path for attackers to achieve code execution by placing malicious scripts in public content that the research agent might index.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest large volumes of untrusted data from various web sources (Twitter, Reddit, general websites). The automation of script execution based on this data creates a high-risk surface for indirect prompt injection, where malicious actors can manipulate the research output to trigger dangerous agent behaviors.
[COMMAND_EXECUTION]: The tool_strategy.md file defines several patterns for piping network-sourced data directly into Python or shell interpreters, such as fetching Twitter timelines or RSS feeds and processing them via python3 -c commands.
[DYNAMIC_EXECUTION]: The skill makes heavy use of dynamic script generation and execution, including runtime-constructed Python parsers for social media data and the automated execution of "reproduction scripts" found during the research phases.

insane-research-main