The Agent Skills Directory

[METADATA_POISONING]: The skill metadata identifies the author as 'Orchestra Research', while the skill body and documentation attribute the framework to 'Tsinghua's THUDM team'. This inconsistency can mislead users regarding the source and trustworthiness of the software.
[DYNAMIC_EXECUTION]: The framework allows for the execution of user-defined Python scripts via the --custom-generate-function-path and --custom-rm-path arguments. This capability enables the agent to load and run arbitrary code at runtime, which could be exploited if malicious script paths are provided or if the scripts themselves are compromised.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by ingesting and processing large quantities of training data from external JSONL files. 1. Ingestion points: The framework reads external data from paths specified by the --prompt-data and --eval-prompt-data flags in SKILL.md and api-reference.md. 2. Boundary markers: The instructions do not define clear delimiters or warnings for the processed data. 3. Capability inventory: The skill has access to shell execution, network downloads, and dynamic Python code loading. 4. Sanitization: There is no evidence of sanitization or validation logic to filter potentially malicious instructions within the ingested datasets.
[COMMAND_EXECUTION]: The documentation provides instructions for running Docker containers with significant host-level access, including --ipc=host and --gpus all, which increases the potential impact of a container escape or malicious process execution.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to download assets and source code from external repositories such as GitHub and Docker Hub which are outside the immediate control of the skill environment.

slime