The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses eval() to execute Python lambda functions generated by a local model (ollama.chat) in Step 4. Although it implements a safety gate to filter for forbidden keywords like import, exec, os, and subprocess, the use of eval on strings generated by an AI model that processes untrusted data is a high-risk pattern. Advanced bypass techniques using Python's introspection or attribute access could potentially circumvent simple keyword filters to achieve arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data (suspect_rows) and interpolates it directly into a prompt for the AI model in generate_fix_logic without robust sanitization or boundary markers.
Ingestion points: suspect_rows variable in cluster_anomalies and generate_fix_logic (SKILL.md).
Boundary markers: Absent; samples are joined with newlines and appended directly to the prompt string.
Capability inventory: The skill uses eval() to run code, providing a direct execution path if the prompt output is manipulated.
Sanitization: Relies on a basic blacklist of strings ('import', 'os', etc.), which can be bypassed by an attacker providing data that causes the model to ignore instructions or output malicious logic using alternative syntax.
[DATA_EXFILTRATION]: The reconciliation_check function in Step 5 includes a trigger_alert mechanism intended for PagerDuty, Slack, or webhooks. While consistent with the skill's purpose for observability, this represents a network egress point that could potentially be misused for data exfiltration if the alert message or configuration is compromised.

agency-ai-data-remediation-engineer