The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/significance_test.py contains logic to modify the module search path (sys.path) by navigating three levels up from its current directory to find a code_assets folder. This path traversal technique (../../../code_assets) for dynamic loading is considered a medium risk as it attempts to access and execute code from the broader host environment rather than staying within the skill's encapsulated directory.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze experimental results from CSV files (e.g., in scripts/analyze_results.py and scripts/leakage_overfit_check.py). This creates a vulnerability surface where maliciously crafted data within these files could influence agent behavior.
Ingestion points: Data enters the system via pandas.read_csv in analyze_results.py and leakage_overfit_check.py.
Boundary markers: None observed; there are no delimiters or specific instructions for the agent to ignore instructions embedded within the experimental data.
Capability inventory: The skill has the ability to execute shell scripts, write JSON and Markdown reports, and generate visualization files (PDF, SVG, PNG).
Sanitization: While the scripts perform numeric conversion (e.g., pd.to_numeric), they do not sanitize text-based fields used for slicing or reporting.
[COMMAND_EXECUTION]: The skill instructions in SKILL.md and example scripts involve executing Python scripts with multiple command-line arguments. While intended for analysis, this provides a mechanism for running complex local processes based on user-provided parameters.

light-result-analysis