The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script resources/simulate.py utilizes importlib.util to load a Python module from a file path specified in the input JSON data (dcf_path).
Evidence: Found in resources/simulate.py within the _load_dcf function.
Risk: Loading modules from computed paths derived from untrusted input allows for the potential execution of arbitrary local Python code.
[INDIRECT_PROMPT_INJECTION]: The skill accepts external JSON payloads that control execution flow and script paths, creating an attack surface for data-driven influence on tool behavior.
Ingestion points: The resources/simulate.py script reads data from standard input or a user-specified file via the _read_payload function.
Boundary markers: There are no explicit delimiters or boundary markers present in the processing logic to distinguish between user data and control parameters.
Capability inventory: The script has the capability to dynamically load and execute local Python modules via _load_dcf and perform arbitrary dictionary updates on the valuation payload through _set_path.
Sanitization: The input strings for paths and file locations are not validated or sanitized against a restricted allowlist before being used to resolve file paths for execution.

monte-carlo-valuation