The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_command.py uses subprocess.run() to execute commands provided via the --command command-line argument. While it uses shlex.split() to prevent simple shell injection, it still allows the execution of arbitrary binaries present on the system.
[REMOTE_CODE_EXECUTION]: The script scripts/write_outputs.py uses importlib.util to dynamically load and execute a Python module from the path ../../../shared/scripts/write_run_bundle.py. This dynamic loading from a computed relative path escapes the skill's own directory structure and creates a dependency on external code that is not part of the skill's own file set.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from the environment.
Ingestion points: scripts/run_command.py captures the stdout and stderr from executed commands in the execute_command function.
Boundary markers: There are no boundary markers or instructions to ignore embedded commands when processing the captured output.
Capability inventory: The skill can execute subprocesses via subprocess.run in scripts/run_command.py and write files via scripts/write_outputs.py.
Sanitization: While the script uses regex to extract metrics, the raw logs are included in the final execution summary without sanitization.

minimal-run-and-audit