The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agnes-understand.py implements a dynamic value resolver in the _resolve_value function that uses subprocess.run(shell=True) to execute commands if a configuration value begins with an exclamation mark (!). This creates a risk of arbitrary command execution if an attacker can influence the content of the local configuration files.
[CREDENTIALS_UNSAFE]: The script is designed to access and read sensitive API keys from local configuration files located at ~/.pi/agent/auth.json and ~/.pi/agent/models.json.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes untrusted visual media (images and videos) from file paths or URLs. It lacks sufficient boundary markers or instructions to ensure the vision model ignores commands embedded within the media.
Ingestion points: The inputs argument in scripts/agnes-understand.py accepts various media types and URLs.
Boundary markers: The script adds simple text labels to separate inputs but does not provide the LLM with explicit instructions to disregard text or commands found inside the images or videos.
Capability inventory: The script is capable of executing shell commands (via the configuration resolver and media processing tools like ffmpeg) and communicating over the network with the Agnes API.
Sanitization: There is no filtering or sanitization of the visual content or extracted text before it is sent to the vision model.

understand-image-video