The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to perform system-level operations:
Remote Retrieval: Executes ssh server "tail -100 /path/to/training.log" to fetch experiment logs. This allows the agent to connect to remote hosts, which could be exploited if an attacker influences the server address or the content returned.
Local Utility Usage: Calls python3 tools/research_wiki.py with various arguments to manage project metadata. This execution depends on the security and integrity of scripts residing within the user's local repository.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it aggregates data from untrusted or external sources for LLM evaluation:
Ingestion points: Data enters the agent's context from wandb history, local files (EXPERIMENT_LOG.md), and remote SSH logs.
Boundary markers: The prompt template uses markdown headers (e.g., Results:, Baselines:) to structure the evaluation, which provides minimal protection against adversarial content embedded within those logs.
Capability inventory: The skill possesses Bash execution, file writing capabilities, and access to the Codex evaluation tool.
Sanitization: There is no specified mechanism to sanitize or validate the ingested experimental data before it is interpolated into the critical evaluation prompt.

aris-result-to-claim