The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions in Step 7.5 direct the agent to execute shell commands via SSH to read the ~/.config/enroot/.credentials file on a remote host. This file typically contains sensitive authentication credentials for container registries.
[REMOTE_CODE_EXECUTION]: The skill documentation in references/model-card-research.md and SKILL.md encourages the use of the deployment.pre_cmd field to download and execute external scripts (e.g., using curl and pip install). The skill further instructs the agent to set NEMO_EVALUATOR_TRUST_PRE_CMD=1, which explicitly enables the execution of these arbitrary commands by the underlying evaluation tool.
[COMMAND_EXECUTION]: The skill performs shell execution of various commands including nel, cat, and ssh. These commands incorporate parameters and arguments dynamically derived from untrusted external data sources such as HuggingFace model cards and checkpoint metadata files.
[PROMPT_INJECTION]: The skill has a significant surface for indirect prompt injection. It is instructed to use WebSearch to research model cards on HuggingFace and to read local or remote checkpoint files (config.json, hf_quant_config.json) to automatically determine deployment configurations. Maliciously crafted data in these external files could trick the agent into generating dangerous command-line arguments or malicious pre_cmd payloads.
[CREDENTIALS_UNSAFE]: The skill targets sensitive credential files and environment variables. While it suggests using .env files for secret management (a safe practice), the automated inspection of ~/.config/enroot/.credentials constitutes an unsafe credential access pattern.

evaluation