The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The bundled scripts scripts/create_github_comment.py and scripts/generate_report.py include a generate_script method that dynamically constructs a shell script using f-string interpolation of a user-provided content parameter. The method then uses chmod(0o755) to make the resulting script executable. This pattern allows the skill to create and prepare arbitrary executable code at runtime based on tool inputs, which is a core component of a remote code execution chain.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to ingest and process performance metrics from external CI/CD environments.
Ingestion points: Performance metrics gathered from the CI/CD environment as described in SKILL.md.
Boundary markers: Absent. There are no delimiters or instructions provided to the agent to ignore instructions embedded within the ingested data.
Capability inventory: The skill is granted Write and Bash capabilities. The included Python scripts facilitate the creation and execution-preparation of new files.
Sanitization: Absent. The scripts directly interpolate input strings into executable templates without escaping or validation.

detecting-performance-regressions