The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to construct and execute shell commands that interpolate user-provided inputs such as <user-ckpt>, <user-csv>, and optional parameters like --batch-size. If these inputs are not properly sanitized or escaped by the agent prior to execution, it could lead to command injection on the host system.
[PROMPT_INJECTION]: The skill processes SMILES data from external CSV files which serves as a surface for indirect prompt injection. Maliciously crafted data could attempt to exploit vulnerabilities in the data preparation scripts or influence the agent's interpretation of the inference results.
Ingestion points: The skill reads data from a user-specified path via the --csv flag in SKILL.md.
Boundary markers: Absent; there are no specific instructions or delimiters provided to the agent to treat the CSV content as untrusted or to ignore instructions embedded within the data.
Capability inventory: The skill utilizes docker run via a helper script, performs file system operations (writing to $RUN_DIR), and executes shell commands.
Sanitization: While the workflow includes validation scripts like check_data.py, these are part of the processing pipeline rather than agent-side security sanitization of the input text.
[COMMAND_EXECUTION]: The 'Replayability' section provides a command template $(jq -r .cmd_replay $RUN_DIR/run.json) for the user to re-execute the workflow. This involves executing a string stored in a generated JSON file as a shell command. If the process that generates this JSON is influenced by malicious input, it could result in the execution of arbitrary commands when the user attempts to replay the run.

kermt-infer