The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/bootstrap_env.py performs shell command execution using subprocess.run() to manage environments and install dependencies. While it avoids shell injection by passing commands as lists, it executes high-risk operations like pip install -r requirements.txt and pip install -e . (editable install) on files located within a user-provided target repository.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external repositories, creating a surface for indirect attacks.
Ingestion points: The scripts/prepare_assets.py script reads and parses README.md and configuration files (YAML, JSON, TOML) for URLs and paths. The scripts/plan_setup.py and scripts/bootstrap_env.py scripts read dependency manifest files.
Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to ignore potentially malicious embedded commands within the processed repository files.
Capability inventory: The skill has the capability to execute shell commands via subprocess.run() in scripts/bootstrap_env.py, specifically targeting environment managers (conda, mamba, venv) and package managers (pip).
Sanitization: No validation or sanitization is performed on the content of the repository files (like requirements.txt or setup.py) before they are passed to the installation tools.

env-and-assets-bootstrap