The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses shell patterns that pipe network responses directly into a Python interpreter. While targeting localhost, this pattern is sensitive to input poisoning if the local server returns unexpected content.
Evidence in SKILL.md: curl -s http://localhost:8000/v1/models | python -m json.tool.
Evidence in scripts/deploy.sh: curl -s "http://localhost:$PORT/v1/models" | python3 -m json.tool and model ID extraction via python3 -c.
Evidence in references/benchmarking.md: The 'coherence gate' pipes generation output from a local endpoint directly into a Python script for validation.
[PRIVILEGE_ESCALATION]: The instructions for handling unsupported models involve modifying framework source files located in system-level directories (/usr/local/lib).
Evidence in references/unsupported-models.md: Recommends using sed -i to patch files like vllm/model_executor/models/mistral3.py inside the deployment environment.
[COMMAND_EXECUTION]: The scripts/deploy.sh script executes various server management commands (nohup, kill, pgrep, ss) based on user-provided or auto-detected parameters. While it performs some single-quoting of metadata to prevent injection, it grants broad control over the server environment.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it reads and processes model-generated output from a local server (health checks and coherence gates) and uses that data to drive logic, such as determining success or benchmarking performance.
Ingestion points: curl responses from /v1/models and /v1/chat/completions (in SKILL.md, deploy.sh, benchmarking.md).
Capabilities: Subprocess execution, file modification (sed), and server lifecycle control.
Sanitization: Partial (uses JSON parsing to extract specific fields).

deployment