The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes the main script of the target skill provided in the skill_path. In scripts/nodes/preflight_target.py, it runs python3 scripts/run.py --schema from the target directory to extract metadata. If the target directory contains malicious code, it will be executed on the host system.
[EXTERNAL_DOWNLOADS]: The scripts/nodes/install_deps.py module automatically identifies and installs dependencies using pip. It reads these dependencies from the target skill's requirements.txt or the dependencies field in its SKILL.md frontmatter. This can lead to the installation of malicious or vulnerable packages if the target skill is untrusted.
[COMMAND_EXECUTION]: The skill heavily relies on subprocess.run across multiple modules to manage its workflow. This includes scripts/nodes/isolate_env.py for creating virtual environments, scripts/nodes/install_deps.py for package management, and scripts/nodes/preflight_target.py for executing target code.
[PROMPT_INJECTION]: As a tool designed to process and verify other skills, it exhibits a surface for indirect prompt injection. It ingests untrusted data from the target skill's SKILL.md and the user-provided demand string, which are then interpolated into JSON briefs (_agent_run_brief.json and _agent_report_brief.json) used to instruct the agent's behavior during the verification process.
Ingestion points: case.json (skill_path, demand), target skill's SKILL.md, and generated artifacts.
Boundary markers: Instructions are passed via structured JSON files, providing some logical separation but no explicit security delimiters.
Capability inventory: Full file system access within the work directory, network access (via pip), and subprocess execution.
Sanitization: The skill performs structural validation of the case file but does not sanitize the content of the demand or the target skill's instructions.

skill-publish-verify