The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identifies and processes external data from local code repositories, including configuration files, logs, and experiment scripts.
Ingestion points: The evidence_scanner.py script and the agent's inspection routines read content from files within a user-provided repo_path (e.g., config.*, logs/, results/).
Boundary markers: The skill incorporates red-lines.md and stance.md to define strict operational boundaries, instructing the agent to treat repo content as evidence rather than instructions.
Capability inventory: The agent can execute shell commands (minimal-reproducible-run), read arbitrary files within the path, and suggest environment dependency installations.
Sanitization: The skill relies on instructional constraints to prevent the execution of malicious content found in repo data rather than technical sanitization.
[COMMAND_EXECUTION]: The skill is designed to run shell commands for experiment reproduction (e.g., minimal-reproducible-run and command_override). While intended for verification and auditing, this capability could be exploited if an attacker provides a repository containing malicious execution scripts or configuration files that the agent attempts to run.
[EXTERNAL_DOWNLOADS]: The agent's fallback logic in agents/experiment_agent.md allows for the installation of missing dependencies ("安装缺失包"). While the instructions state this requires explicit user consent, the automated suggestion of package installation from untrusted repository sources (e.g., requirements.txt) presents a supply chain risk.

academic-experiments