The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using arguments extracted from external configuration files or user input.
Evidence: The workflow interpolates <dataset_path>, <imgsz>, and <comma-separated from data.yaml> directly into shell commands like yolo-validate <dataset_path> and python scripts/profile_dataset.py. Maliciously crafted values in these files could lead to command injection if not properly sanitized.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of dataset labels and configuration files, which could be used to influence agent behavior through reporting or downstream tasks.
Ingestion points: yolo-project.yaml, data.yaml, and dataset label files.
Boundary markers: None present.
Capability inventory: Shell command execution, script execution, and file system writes to training-plan.md and experiments/dataset_audit.md.
Sanitization: No evidence of sanitization for data extracted from labels or configs before interpolation into reports or commands.
[DYNAMIC_EXECUTION]: The skill relies on and executes local Python scripts as part of its core workflow.
Evidence: Calls to python scripts/draw_annotations.py and python scripts/profile_dataset.py are central to the workflow. The source code for these referenced scripts is not included in the skill definition for verification.

review-dataset