The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructions in references/paidf-anomalygen.md explicitly use chmod 777 on host directories ($COSMOS, $DS, and the checkpoint directory) to ensure the Docker container has write access. This grants global read, write, and execute permissions to these paths.\n- [DATA_EXFILTRATION]: The scripts/align_token_usage.py script accesses and parses sensitive Claude Code transcript logs located at ~/.claude/projects/ to extract token usage information. Accessing transcript logs is a significant data exposure risk as they contain full session history.\n- [DYNAMIC_EXECUTION]: The skill relies on torch.load() and safetensors.torch.load_file() to load model weights (e.g., in references/visual-changenet.md). torch.load() is vulnerable to arbitrary code execution if the pickled data is malicious.\n- [EXTERNAL_DOWNLOADS]: The skill fetches model weights and datasets from Hugging Face and pulls Docker images from NVIDIA's registry (nvcr.io). These are recognized as trusted organizations and well-known services.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided CSV files for training and evaluation. These ingestion points lack sanitization for potential prompt injection strings that could influence the agent's behavior when processing or reporting on the results.\n
Ingestion points: training_set.csv, validation_set.csv, and testing_set.csv (referenced in SKILL.md and references/data-layout.md).\n
Boundary markers: None.\n
Capability inventory: Spawns Docker containers (docker run) via the Bash tool, writes files, and executes Python scripts.\n
Sanitization: No sanitization is performed on the content of the ingested CSV files.

tao-run-deft-aoi