The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/preflight_check.py dynamically generates and executes Python code snippets at runtime.
The functions check_onnx_community and detect_task construct Python scripts as strings using f-strings and execute them using subprocess.run([sys.executable, "-c", script]).
[COMMAND_EXECUTION]: The dynamic execution pattern in scripts/preflight_check.py is vulnerable to command injection because it incorporates user-supplied input (model_id) directly into executable code strings without sufficient sanitization.
An attacker could provide a model_id containing Python escape sequences (e.g., "); import os; os.system('...'); #) to execute arbitrary commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted model identifiers from external sources (HuggingFace Hub) which are then used in security-sensitive operations.
Ingestion points: User-provided model_id or HuggingFace URL passed to scripts/preflight_check.py and optimum-cli commands.
Boundary markers: None identified in the script or instructions to prevent the agent from executing injected commands.
Capability inventory: The skill has the ability to execute shell commands, run Python scripts, and perform network operations to HuggingFace Hub.
Sanitization: The extract_model_id function uses basic regular expressions for URL parsing but does not sanitize the resulting identifier against code injection characters like quotes or semicolons before it is used in code generation.

onnx-webgpu-converter