The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/windows-run.py script executes various system commands using the subprocess module, including docker, git, systemctl, and findmnt. It also executes internal bash scripts and PowerShell commands to verify the host environment.
[CREDENTIALS_UNSAFE]: The skill handles sensitive model API keys (e.g., anthropic_key) by reading them from a file provided via the --credential-file argument. While it enforces restrictive file permissions (mode 0600) and attempts redaction during evidence collection, the management of raw credentials in a testing harness is a security-sensitive task.
[INDIRECT_PROMPT_INJECTION]: The validation logic involves processing a "retained agent's real reply" to confirm test success, creating a surface for indirect prompt injection.
Ingestion points: The skill ingests agent output for verification, as noted in SKILL.md and the run_wizard flow in scripts/windows-run.py.
Boundary markers: The processing logic for the agent's response does not appear to use explicit boundary markers to delimit untrusted content.
Capability inventory: The skill possesses extensive capabilities, including shell command execution (subprocess), file system modifications (os.open, os.replace), and network operations via Docker.
Sanitization: Although the skill documents "credential redaction" and "sanitized evidence" collection, the verification of agent output is a comparison that lacks specific sanitization for injection patterns.
[DYNAMIC_EXECUTION]: The script scripts/windows-run.py uses importlib.util to dynamically load Python modules from a sibling directory (e2e-wizard). It also encodes the scripts/windows-engine.ps1 script as a Base64 string for execution via powershell.exe -EncodedCommand.
[PRIVILEGE_ESCALATION]: The skill requires noninteractive sudo access to verify the WSL2 environment and perform installation tasks, representing a high-privilege requirement for the user.

e2e-windows