The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied CSV files where malicious content in column names can influence shell command construction.
Ingestion points: check_data.py and prepare_data.py read and parse the user-supplied --csv file to identify target columns.
Boundary markers: The SKILL.md instructions advise the agent to single-quote target names containing metacharacters, but there are no robust programmatic boundaries or 'ignore' instructions in the prompt interpolation.
Capability inventory: The kermt_container.sh script executes commands inside a Docker container using bash -c "$*". This container environment has network access and write access to host-mounted directories.
Sanitization: While the skill validates SMILES strings and checks for numeric data in target columns, it does not sanitize the column names themselves for shell metacharacters before they are passed to the kermt_container.sh wrapper.
[COMMAND_EXECUTION]: The skill uses a shell wrapper (kermt_container.sh) that executes strings via bash -c. This creates a command injection surface if the agent interpolates unsanitized data (like CSV headers) into the command.
[EXTERNAL_DOWNLOADS]: The skill fetches a pretrained model bundle from the official NVIDIA repository on Hugging Face (nvidia/NV-KERMT-70M-v2). This operation is governed by a consent gate requiring explicit user approval or a specific CLI flag.
[DYNAMIC_EXECUTION]: The skill implements robust security practices for data deserialization.
Safe Loading: scripts/_utils.py uses a restricted pickle.Unpickler that limits allowed classes to a specific set of molecular vocabulary types, mitigating risks associated with arbitrary object deserialization.
Secure Checkpoints: scripts/_utils.py loads PyTorch checkpoints using weights_only=True and a strictly defined list of safe_globals, following industry best practices for model loading security.

kermt-finetune