The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user and agent to download a shell script (get_model.sh) from the vendor's GitHub repository and source it directly into the current shell environment. This pattern allows for arbitrary code execution if the remote resource is compromised.
[REMOTE_CODE_EXECUTION]: Several procedures in SKILL.md and troubleshooting.md involve piping the output of curl requests (targeting localhost:8200) directly into a Python interpreter or the json.tool module for processing. This is a high-risk pattern that executes remote (local) content.
[EXTERNAL_DOWNLOADS]: The skill fetches the get_model.sh utility from the open-edge-platform/edge-ai-libraries repository on GitHub. While this is an author-owned resource, it represents an external dependency fetched at runtime.
[COMMAND_EXECUTION]: The skill relies heavily on shell script execution for service management (run_service.sh) and model retrieval, exposing the system to potential command injection via manipulated environment variables or user-supplied arguments.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing untrusted user data into shell commands.
Ingestion points: User-supplied values for model name, revision, hub, and download_path in SKILL.md.
Boundary markers: None identified. There are no instructions to sanitize or validate these inputs before they are interpolated into bash commands.
Capability inventory: The agent has the capability to execute shell commands, source scripts, and pipe network output to a Python interpreter.
Sanitization: No escaping or filtering is applied to the user strings, allowing potentially malicious characters (e.g., semicolons, backticks) to be included in generated commands.

model-download-user