The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation guide in references/installation.md references a Docker image pablovd/denario:latest from an unverified third-party account rather than the official project organization or author account.
[DYNAMIC_EXECUTION]: The get_results() method described in references/research_pipeline.md generates and executes computational code using scientific libraries based on the research methodology. This involves script generation and execution from agent-derived instructions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted datasets and research contexts through the set_data_description() method, which are then used to generate ideas and methodologies that drive subsequent code execution, creating an attack surface.
Ingestion points: Untrusted data enters the agent context through the set_data_description() method in SKILL.md and references/research_pipeline.md.
Boundary markers: No explicit boundary markers or "ignore instructions" warnings are documented for the data description inputs to prevent the agent from following instructions embedded in the data.
Capability inventory: The skill performs code execution through the get_results() method as described in references/research_pipeline.md and SKILL.md.
Sanitization: There is no mention of sanitization, validation, or filtering for the external data descriptions provided by the user before they are processed by the agents.
[COMMAND_EXECUTION]: The documentation includes commands that involve piping remote scripts to a shell, such as curl https://sdk.cloud.google.com | bash in references/llm_configuration.md. While this targets a well-known service, it demonstrates a pattern of remote code execution.

denario