The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's core workflow and reference templates (e.g., references/skeleton-template.py) guide the agent and developer to use torch.load(..., weights_only=False) when loading model checkpoints. Disabling the weights_only restriction in PyTorch allows the deserialization of arbitrary Python objects, which can be leveraged to execute malicious code upon loading a checkpoint.
Evidence: SKILL.md Step 6 explicitly states: "Use weights_only=False only when loading a pickled full PyTorch object is required."
Evidence: references/skeleton-template.py (line 131) and references/method-templates.py (line 125) provide code examples implementing this insecure loading pattern.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch model weights and assets from remote registries including HuggingFace (hf://), NVIDIA GPU Cloud (ngc://), and S3. While these are well-known services, their use as sources for insecurely loaded data (weights_only=False) creates a significant supply-chain risk if a repository or bucket is compromised.
Evidence: SKILL.md instructions specify resolving checkpoint files from these external protocols.
[PROMPT_INJECTION]: The skill uses the $ARGUMENTS parameter to ingest external reference material from URLs or local paths. This creates a surface for indirect prompt injection, where an attacker could place malicious instructions in a reference repository or documentation to manipulate the agent's output or command execution.
Ingestion points: SKILL.md Step 0 instructions use $ARGUMENTS to capture model variables and metadata from external sources.
Boundary markers: None are specified to separate reference content from system instructions.
Capability inventory: The skill permits file writes to the repository and execution via uv run.
Sanitization: There is no guidance on sanitizing or validating inputs extracted from these external reference materials.

earth2studio-create-diagnostic