The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a version of the google-colab-cli from a non-official GitHub repository (itzrnvr/google-colab-cli) to enable Windows support. This bypasses official package registries like PyPI.
[REMOTE_CODE_EXECUTION]: The skill is built to execute arbitrary code on remote Google Colab CPU/GPU/TPU instances through the colab exec and colab run commands.
[COMMAND_EXECUTION]: The skill relies on executing shell commands locally to interact with the colab CLI tool.
[CREDENTIALS_UNSAFE]: The instructions explicitly mention the path to sensitive Google OAuth2 tokens at ~/.config/colab-cli/token.json. While it includes a warning against printing these tokens, identifying the path facilitates targeted credential theft if the environment is compromised.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes data from external Colab sessions (logs, exported notebooks, and files) which may contain malicious instructions.
Ingestion points: Data is brought into the agent's context through colab log and colab download operations.
Boundary markers: The instructions lack explicit delimiters or sanitization rules for handling output from remote sessions.
Capability inventory: The agent can execute shell commands and write to the local file system.
Sanitization: No specific sanitization or filtering of remote content is defined.

colab-cli