The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to clone an external repository from https://github.com/hamelsmu/hamelnb.git and subsequently execute a Python script (jupyter_live_kernel.py) from that repository using uv run. This represents a high-risk pattern of downloading and executing code from an unverified third-party source.
[COMMAND_EXECUTION]: The skill provides instructions to start a JupyterLab server with critical security features disabled. Specifically, it uses --IdentityProvider.token='', --ServerApp.password='', and --ServerApp.disable_check_xsrf=True. This configuration allows unauthenticated, cross-site request forgery-vulnerable access to the Jupyter kernel, enabling arbitrary code execution on the host machine by any local or potentially remote attacker who can reach the service port.
[DYNAMIC_EXECUTION]: The primary function of the skill is the runtime execution of arbitrary Python code strings via a live Jupyter kernel. This capability, when combined with untrusted inputs, provides a powerful primitive for executing arbitrary commands, accessing the file system, and performing network operations.
[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection due to its core design.
Ingestion points: The --code argument of the execute command in SKILL.md accepts raw Python code strings for execution.
Boundary markers: Absent. The skill does not implement delimiters or provide instructions to ignore embedded malicious content within the code strings it processes.
Capability inventory: The skill provides full Python execution capabilities (via uv run "$SCRIPT" execute), which includes the ability to perform file system writes, network requests, and subprocess execution across the host environment.
Sanitization: Absent. There is no evidence of validation, escaping, or filtering of the code content before it is dispatched to the Jupyter kernel.

jupyter-notebook