The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions that deliberately weaken security oversight and enable unchecked command execution.
The agent is instructed in references/workflow_heavy.md (Step 2) and references/workflow_light.md (Step 1) to create local configuration files (.claude/settings.local.json or .claude/settings.json) that grant unrestricted, non-interactive "allow" permissions for tools such as Bash, Write, Edit, and Agent. This configuration bypasses standard human-in-the-loop validation for terminal and file-system operations.
The workflow requires the agent to execute a broad array of shell commands for project scaffolding and file management, including recursive copying (cp -r), repository initialization (git init), and automated search/retrieval.
[REMOTE_CODE_EXECUTION]: The workflow involves rendering processes that can execute arbitrary code segments.
The instructions mandate the use of quarto render to generate final reports. Quarto documents (.qmd) can contain executable code blocks (Python, R, Julia) that are run during the rendering process. Since the AI drafts these documents using information retrieved from external sources, this creates a potential vector for executing malicious code embedded in research data.
[EXTERNAL_DOWNLOADS]: The skill directs the AI to automatically download and process content from numerous external domains.
The agent is instructed to fetch full-text PDF documents and datasets from various institutional and financial websites (e.g., IMF, World Bank, IEA). While the listed sources are generally reputable, the automation of these fetches combined with the permission bypass increases the risk of ingesting malicious content without scrutiny.
[DYNAMIC_EXECUTION]: The skill uses techniques for dynamic code and module management.
The scripts/chart_template.py script and the generated 5_scripts/_path.py script manipulate sys.path and use dynamic imports (__import__) to configure the execution environment. This behavior is used to link skill components but represents a technique often associated with loading code from untrusted paths.

analyst-research