The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install binary Python wheels (.whl) and source code from multiple unverified external sources, including personal GitHub repositories and Hugging Face datasets.
Evidence found in references/3d-models.md linking to github.com/adithyaxx and github.com/LDYang694 for specialized Blackwell GPU wheels.
Evidence in references/3d-cuda-extensions.md for fetching extensions via git+https://github.com/....
[REMOTE_CODE_EXECUTION]: By recommending the installation of binary wheels from personal GitHub release pages, the skill risks the execution of malicious code that could be embedded in these binaries, representing a significant supply chain vulnerability.
[DYNAMIC_EXECUTION]: The skill utilizes subprocess.run and os.system to perform runtime JIT (Just-In-Time) compilation of C++ and CUDA extensions. While described as a technical necessity for ZeroGPU environments, runtime compilation of external or generated source code is a high-risk pattern.
Evidence in references/3d-cuda-extensions.md: subprocess.run(shlex.split("pip install --no-build-isolation ./texture_baker"), ...).
Evidence in references/3d-models.md: os.system("cd ... && bash compile_mesh_painter.sh").
[INDIRECT_PROMPT_INJECTION]: The skill provides instructions to search for and read existing Spaces, including their app.py and requirements.txt files, and adapt them. This ingestion of untrusted data from the Hugging Face Hub, combined with the agent's capability to execute shell commands and write to the filesystem, creates a surface for indirect prompt injection.
Ingestion Points: hf spaces search, hf download (documented in SKILL.md).
Boundary Markers: The skill includes a 'Verification Protocol' and 'Anti-Patterns' section advising not to treat external content as trusted instructions.
Capability Inventory: File creation, repository management, and shell command execution via the hf CLI.
[COMMAND_EXECUTION]: The skill extensively uses shell commands for repository management, hardware configuration, and secret setting. While these are primary functions, the flow of potentially untrusted data into these commands (e.g., from search results or downloaded files) requires strict validation.

huggingface-spaces