The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill clones external repositories using git clone <BASE_REPO> and subsequently implements and executes code within that environment. This pattern allows the execution of untrusted code from external sources.
[COMMAND_EXECUTION]: The skill heavily relies on Bash(*) to perform operations such as nvidia-smi, ssh <server>, and interacting with cloud providers like vast.ai and modal. These commands use variables derived from the experiment plan or user input, which are vulnerable to injection attacks.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of external codebases via Git when the BASE_REPO constant is set.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it parses multiple markdown files (e.g., EXPERIMENT_PLAN.md, FINAL_PROPOSAL.md) to determine its execution logic, including script implementation and deployment commands.
Ingestion points: Reads files like EXPERIMENT_PLAN.md and FINAL_PROPOSAL.md (SKILL.md).
Boundary markers: No clear delimiters or instructions are provided to the agent to disregard malicious directives embedded within these files.
Capability inventory: Uses Bash(*), Write, and Edit tools to generate and run code.
Sanitization: There is no evidence of validation or escaping for the data extracted from the experiment plans before it is used in code generation or shell commands.

aris-experiment-bridge