The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/write_outputs.py utilizes importlib.util to dynamically load and execute a Python module from a path computed at runtime (../../../../shared/scripts/write_run_bundle.py). This technique can be exploited to execute arbitrary code if an attacker can manipulate the filesystem structure or the contents of the target script.
[REMOTE_CODE_EXECUTION]: The script scripts/run_command.py facilitates the execution of shell commands provided via CLI arguments. Although it uses shlex.split to mitigate shell-level injection, it still allows for the execution of any binary or script present on the system, which is a significant risk if the commands are sourced from untrusted data.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and executing commands often found in repository documentation (e.g., README files). This creates an attack surface where a malicious repository could influence the agent's behavior to execute unauthorized or harmful commands.
Ingestion points: Untrusted data enters the agent context through the reproduction goals and commands described in SKILL.md and repository files.
Boundary markers: Absent. The provided scripts do not implement mechanisms to distinguish between safe instructions and potentially malicious injected data.
Capability inventory: The skill possesses capabilities for arbitrary subprocess execution and dynamic Python module loading.
Sanitization: Absent. No validation or sanitization is performed on the commands before they are passed to the execution environment.

minimal-run-and-audit