The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses the Python pickle module to serialize and deserialize embedding indexes. Python's pickle module is notoriously insecure and can execute arbitrary code during the loading process if a malicious index file is provided.
Evidence: The snap command in scripts/snap.py calls pickle.load(fh) to load the index file specified by the --index argument.
[DYNAMIC_EXECUTION]: The skill's test suite uses the eval() function to dynamically parse strings extracted from the source code, which is a dangerous practice that can lead to code execution if the source file is manipulated.
Evidence: In tests/test_snap.py, the function test_documented_backends_are_all_constructible reads the script text and calls eval() on a portion of the code to extract CLI choices.
[COMMAND_EXECUTION]: The test suite invokes the skill's CLI script using system calls, which involves shell command execution.
Evidence: tests/test_snap.py uses subprocess.run() to execute the snap.py script for various integration tests.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from multiple files for embedding comparison, which could be exploited by embedding malicious instructions in the processed items or labels.
Ingestion points: Data is read from files provided via the --vocab, --labels, and --items arguments in scripts/snap.py.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands in the ingested data.
Capability inventory: The skill has the capability to read and write local files (via pickle and stdout redirection) and performs vector calculations. It does not have direct network or high-privilege system access.
Sanitization: No sanitization or filtering of input strings is performed before they are passed to the embedding models (TfidfVectorizer or SentenceTransformer).
[EXTERNAL_DOWNLOADS]: The skill can fetch pre-trained models from a well-known service if a specific backend is enabled.
Evidence: Selecting the minilm backend in scripts/snap.py triggers the sentence-transformers library to download models from Hugging Face. This is a standard operation for this type of tool.

hallucinating-labels