The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted datasets and literature excerpts which could contain embedded instructions. This risk is effectively mitigated by the skill's architecture and guidelines.
Ingestion points: scripts/audit_dataset.py and scripts/inspect_outputs.py read external JSON dataset files.
Boundary markers: SKILL.md and references/security.md explicitly instruct the agent to treat all dataset content as data only and never follow embedded instructions.
Capability inventory: Bundled scripts are restricted to local file I/O and standard library operations; they do not perform network requests or execute text found in data fields.
Sanitization: The skill uses json.load with custom hooks to prevent duplicate keys and non-standard constants. YAML parsing in scripts/_common.py uses yaml.SafeLoader and scans for forbidden tokens like aliases and anchors.
[DYNAMIC_EXECUTION]: The skill documentation identifies a potential risk in the upstream hypogenic package's use of Redis/pickle for caching. However, the skill provides specific remediation (advising users to disable caching for sensitive work) and its own bundled scripts avoid any use of pickle or unsafe deserialization.
[SAFE]: The skill implements proactive security features such as:
Credential Protection: The SECRET_VALUE_RE in scripts/_common.py actively detects and rejects strings that appear to be API keys in configuration files.
Path Validation: The checked_root and checked_input_file functions in scripts/_common.py prevent directory traversal attacks and symlink exploitation by enforcing strict lexical root boundaries.
Deterministic Planning: The scripts/plan_run.py tool allows for cost and token upper-bound estimation without requiring model imports or network access.

hypogenic