The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's primary function is to execute Python and Node.js scripts via a shell wrapper (scripts/code-sandbox/run.sh). Although a validator (validate.sh) is used, the documentation explicitly states it provides 'lightweight guardrails' and 'not true OS-level isolation,' which indicates that sophisticated command injection or bypass techniques could likely circumvent the checks.
[REMOTE_CODE_EXECUTION]: By allowing the agent to write and execute scripts from /tmp/, the skill enables arbitrary code execution. If the content of these scripts is derived from untrusted user input, an attacker could potentially execute malicious logic within the agent's environment.
[DATA_EXFILTRATION]: The skill provides an --allow-net flag that explicitly enables network access. Even when this flag is not used, the documentation notes that network blocking is 'advisory' and relies on the script opting out via the SANDBOX_NO_NET environment variable. A malicious script can ignore this variable to exfiltrate sensitive files accessed from the workspace.
[PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection (Category 8). It ingests untrusted data in the form of scripts, possesses high-privilege capabilities (file system access, network operations), and lacks robust sanitization beyond a bypassable blacklist in validate.sh.
[CREDENTIALS_UNSAFE]: While the validator attempts to block literals like API_KEY or SECRET, this is a partial protection. The skill can still be used to read configuration files or environment variables that contain credentials if the blacklist is bypassed.

code-sandbox