The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's evaluation framework in eval/run-eval.sh incorporates untrusted agent output directly into code execution strings. The range_check function extracts values from the agent's JSON response and interpolates them into a Python command (python3 -c "v=$val; ...") without sanitization or quoting. A malicious response could inject arbitrary Python code (e.g., 10; import os; os.system('...')) which would then be executed by the developer running the evaluation script.
[COMMAND_EXECUTION]: The script eval/run-eval.sh executes several subprocesses including python3, node, and the claude CLI. The lack of proper escaping when handling data retrieved from agent responses facilitates a command injection vector that could lead to full system compromise of the environment where evaluations are performed.
[INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting free-text creative descriptions from users, creating a surface for indirect prompt injection. There are no boundary markers or instructions to ignore embedded commands within the ingested vision descriptions.
Ingestion points: User-provided creative ideas and scene descriptions in SKILL.md.
Boundary markers: None present.
Capability inventory: The skill generates complex text prompts and technical settings tables, which are subsequently parsed by the vulnerable evaluation scripts.
Sanitization: No validation or escaping is applied to the untrusted user inputs before they are incorporated into the agent's internal reasoning flow.

comfyui-prompt-interview