The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions suggest the use of a replay command stored in the cmd_replay field of the run.json manifest file (e.g., $(jq -r .cmd_replay $MANIFEST)). This encourages the execution of arbitrary commands defined in an external, potentially untrusted file.
[COMMAND_EXECUTION]: The workflow uses shell command templates like docker logs -f $container_name and ls -1t $logs_dir/*.log where the variables are sourced from user input or external files. The lack of explicit sanitization or validation for these variables creates a risk of shell command injection if they contain metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and summarizes data from training logs and result CSVs which could contain adversarial content intended to mislead the agent.
Ingestion points: run.json, *.log files, and test_result.csv.
Boundary markers: No specific boundary markers or 'ignore' instructions are provided to the agent for processing these file contents.
Capability inventory: The skill has access to docker commands, file system navigation (ls), and file reading utilities (tail).
Sanitization: The instructions do not require the agent to sanitize or escape the content of the logs or manifest fields before using them in summaries or output tables.

kermt-monitor