The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/agent.py performs dynamic loading of shared libraries using the pkcs11.lib(lib_path) method. The library path is taken directly from the --lib command-line argument without validation against a whitelist. This allows for the loading and execution of arbitrary binary code if the path points to a malicious .so or .dll file.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from hardware tokens which could be used to influence the agent's behavior if malicious strings are stored in HSM object labels or manufacturer fields.
Ingestion points: HSM metadata such as token_label, token_manufacturer, and object.label are read into the agent context in scripts/agent.py via the enumerate_slots and list_objects functions.
Boundary markers: None; HSM-derived strings are interpolated directly into JSON output without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has the capability to load dynamic libraries and execute cryptographic operations on the host.
Sanitization: There is no sanitization or escaping of strings retrieved from the HSM before they are returned to the agent context.

performing-hardware-security-module-integration