The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a mechanism for the agent to execute arbitrary shell commands inside a Docker container using the syntax bash tools/debugger/client.sh run "<command>". This gives the agent unconstrained shell access within the container environment.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection. If the agent is instructed to 'run tests' or 'debug' based on content it reads from untrusted sources (like a pull request or a malicious file in the repository), it could be tricked into executing harmful commands.
Ingestion points: User prompts and repository files (e.g., test scripts, documentation) that the agent might process before deciding to execute a command.
Boundary markers: Absent. There are no instructions to wrap or sanitize the commands being passed to the relay script.
Capability inventory: Full shell execution capability via tools/debugger/client.sh inside the Docker container.
Sanitization: None. The skill documentation does not mention any validation or filtering of the command string.
[DYNAMIC_EXECUTION]: The tool relies on the dynamic construction and execution of shell commands at runtime, which is a high-risk pattern when combined with untrusted input.

modelopt-debug