The Agent Skills Directory

[SAFE]: The skill includes multiple local utility scripts (scripts/env_contract_validator.py, scripts/inspect_checkpoint.py, scripts/validate_plan.py) that facilitate the validation of Gymnasium environment contracts and training configurations using strict JSON schema validation and deterministic logic without importing external plug-ins or executing untrusted code.
[REMOTE_CODE_EXECUTION]: The skill implements proactive security measures against remote code execution via scripts/inspect_checkpoint.py, which enables the inspection and hashing of model checkpoints while explicitly avoiding dangerous deserialization methods like torch.load or pickle.load that are commonly exploited for code injection.
[DATA_EXPOSURE]: Documentation and plan-generation scripts (scripts/train_template.py) correctly handle external logging credentials by identifying the required environment variable names (e.g., WANDB_API_KEY) while including explicit technical checks to ensure these values are never read, printed, or logged by the agent.
[EXTERNAL_DOWNLOADS]: Technical documentation (references/native-5.md) identifies that upstream build scripts for the PufferLib native extension may fetch external dependencies (such as Raylib or Box2D) and provides clear guidance on pinning these resources and verifying their integrity to mitigate supply chain risks. These downloads are associated with the target library's build process and are not executed by the skill itself.
[PATH_TRAVERSAL]: The skill's shared helper module (scripts/_common.py) contains a resolve_local_path function that enforces strict boundary checks, ensuring that all file operations are confined to a designated root directory and effectively preventing directory traversal attacks.

pufferlib