The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/audit_provenance.py dynamically loads Python modules from relative paths using importlib.util. Specifically, the _load function calls exec_module on scripts located in sibling skill directories such as inspect-content-provenance, verify-content-credentials, audit-metadata-privacy, and detect-text-watermark.
[REMOTE_CODE_EXECUTION]: The skill invokes an external binary (c2patool) through the run_tool function in scripts/provenance_core.py. The path to this binary is a user-controlled parameter provided at runtime, which allows for the execution of arbitrary local files if an attacker-controlled path is passed to the tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted assets (images, documents, and text files) to extract metadata and return a summary to the AI agent. This creates a vulnerability where malicious instructions hidden in the file content could be processed and interpreted by the agent when it reads the audit results.
Ingestion points: Asset content is read via read_head and read_text_stream functions in scripts/provenance_core.py.
Boundary markers: The audit output is structured as JSON, but field values like unknowns and reason directly incorporate data derived from the analyzed file content without specific delimiters.
Capability inventory: The skill possesses file-read and subprocess-execution capabilities.
Sanitization: The skill does not implement sanitization or filtering to prevent instruction injection from the data extracted from analyzed assets.

audit-provenance