The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill transmits arbitrary Python code provided in the 'code' input field to a remote backend (inference.sh) for execution. While marketed as sandboxed, this functionality enables Remote Code Execution by design to facilitate the skill's purpose.\n- [COMMAND_EXECUTION]: The skill requires the 'belt' CLI tool for operation, instructing the agent or user to execute shell commands such as 'belt login' and 'belt app run' to interact with the service.\n- [EXTERNAL_DOWNLOADS]: References external resources and installation scripts from 'raw.githubusercontent.com/inference-sh' and 'cloud.inference.sh', which are used to set up the execution environment.\n- [DATA_EXFILTRATION]: The environment comes pre-installed with network-capable libraries like 'requests', 'httpx', and 'selenium'. This creates a potential vector for exfiltrating sensitive data from the agent's context to external servers if the generated Python code is not properly sanitized.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted code strings and web content without explicit boundary markers or sanitization. Evidence Chain: 1. Ingestion points: 'code' input field and scraped web content (SKILL.md); 2. Boundary markers: Absent; 3. Capability inventory: Remote code execution, network requests, and file system writes (SKILL.md); 4. Sanitization: Absent.

python-executor