The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as its primary function is to ingest and process untrusted project files including training scripts, READMEs, and configuration YAMLs.
Ingestion points: The skill reads train.py, README.md, config.yaml, and requirements.txt from user-supplied directories.
Boundary markers: Instructions in SKILL.md require static inspection and anomaly reporting, though no specific template markers are used to encapsulate untrusted content.
Capability inventory: The skill performs file system writes and executes shell commands for dependency installation and local job simulation.
Sanitization: The skill's requirements mandate auditing all dependencies, redacting sensitive values from command logs, and obtaining explicit user confirmation before any installation or execution steps.
[PROMPT_INJECTION]: Several test fixtures, such as evals/files/injection-pt/README.md and evals/files/injection-pt/train.py, contain adversarial instructions designed to trick agents into bypassing safety filters, skipping local validation, and exfiltrating model weights to external endpoints. These are correctly identified as test data in the skill's source documentation.
[CREDENTIALS_UNSAFE]: The fixture evals/files/injection-pt/requirements.txt includes a hardcoded token (FAKE-eval-token-3f9a1b) within an --extra-index-url parameter. This is a synthetic credential used to test the agent's redaction capabilities.
[REMOTE_CODE_EXECUTION]: The evaluation requirements include references to remote code execution vectors, specifically a git-based dependency (https://example.com/evil/telemetry.git) and a typosquatted package name (torchvisiom), used to verify the skill's supply-chain auditing logic.

nvflare-convert-pytorch