The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill implements a 'SkillWriting' mechanism where the agent generates Python code, saves it to a persistent libs/ directory, and hot-reloads it into the active process using self.libs.reload. This allows for the execution of arbitrary logic authored by the LLM during a session. Although mitigated by linting (e.g., E001 for forbidden builtins), the agent maintains the capacity to modify its own runtime environment.
[COMMAND_EXECUTION]: The skill requires nemo.shell to perform filesystem operations. The agent uses self.shell.write and self.shell.edit to manage the code lifecycle of its persistent libraries, granting it direct control over local files.
[PROMPT_INJECTION]: The @slash_command functionality creates a feedback loop where the command's return value is automatically treated as a new user message or prompt, which could be exploited if the command processes untrusted data.
Ingestion points: Arguments passed to @slash_command and the return string of the command function.
Boundary markers: The skill documentation does not define specific delimiters or instructions to ignore embedded commands in the returned prompt content.
Capability inventory: The agent can utilize self.shell for file manipulation and self.libs for dynamic code loading.
Sanitization: While library reloading involves linting for forbidden imports, the slash command return path lacks explicit sanitization or filtering before the content is re-ingested as a prompt.

nooa-self-extending