The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation instructs users to set the environment variable TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1 when loading certain checkpoints. Disabling the weights_only safety feature in PyTorch allows the deserialization of arbitrary Python objects through pickle, which can lead to remote code execution if the model checkpoint is malicious.
Evidence (SKILL.md): "For checkpoints produced by the same trusted TAO train/AutoML workflow, set TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD=1 in downstream evaluate, inference, export, or resume/retrain job env vars so Lightning can load the full checkpoint."
[COMMAND_EXECUTION]: The skill provides numerous examples and templates for executing shell commands via Docker and the ml_recog CLI tool. These commands involve mounting host directories and accessing system GPUs, which requires significant privileges.
Evidence (references/tao-deploy-metric-learning-recognition.md): The file contains several docker run --gpus all --rm commands targeting the nvcr.io/nvidia/tao/tao-toolkit container registry.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface area for indirect prompt injection by processing external dataset paths (S3 buckets and local directories) and spec files that influence the agent's generated command arguments.
Ingestion points: Dataset paths interpolated into spec overrides and command lines (SKILL.md, references/skill_info.yaml).
Boundary markers: None explicitly mentioned for dataset content, though spec files use standard YAML formatting.
Capability inventory: Execution of Bash commands, Docker containers, and local file read/write via the ml_recog tool.
Sanitization: None detected for the contents of the datasets or external checkpoints.

tao-train-metric-learning-recognition