The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes scripts/llama_batch.py, which executes the llama-completion binary via subprocess.Popen. This is the intended functionality for running local model inference. The script implements significant security controls: it sanitizes the execution environment by removing sensitive variables like HF_TOKEN and all LLAMA_* configuration, enforces a strict wall-time deadline, caps combined stdout/stderr bytes to prevent resource exhaustion or log flooding, and utilizes POSIX process groups to ensure all child processes are terminated upon cleanup.
[DATA_EXPOSURE]: Instructions in SKILL.md and the references/ directory explicitly advise against the exposure of unredacted credentials, API keys, or environment files. The skill mandates loopback binding (127.0.0.1) for initial server testing and provides clear guidance on redaction of sensitive prompts and tokens before sharing logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user prompts and GGUF models (ingestion points). It mitigates injection risks by instructing the agent to use boundary markers, verify chat templates against model metadata, and use fixed/short prompts for initial verification. The llama_batch.py script further restricts the impact of malicious inputs by validating numeric budgets (tokens, context size) and avoiding direct shell interpolation of file paths.
[SAFE]: No suspicious external downloads, obfuscation, or persistence mechanisms were detected. The skill uses official repository links for the ggml-org organization and follows industry-standard security practices for local LLM operation. The included Python scripts demonstrate defensive programming patterns, including restrictive file permissions (0700) for output directories.

llama-cpp