The Agent Skills Directory

[DYNAMIC_EXECUTION]: The report generation script scripts/build_report_v2.py includes a load_data function that utilizes importlib.util.spec_from_file_location and spec.loader.exec_module to dynamically load a local Python file (v2_data.py) as a module at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface as it ingests untrusted data from various external sources, including Advanced Patent Search results, scientific literature, and web research for news (Workflow steps 4, 7, and 8). The agent is instructed to use this retrieved content to populate the v2_data.py file. Since this file is subsequently imported and executed as Python code, a malicious external source could potentially influence the agent to write executable code, leading to arbitrary code execution.
[COMMAND_EXECUTION]: The SKILL.md file (step 12) explicitly instructs the agent to execute shell commands to run the Python report builder script from the working directory.

create-technology-intelligence-briefing-ip