The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run various shell commands for verification and reproduction purposes, such as node harness.mjs and gbrain routing-eval.
[CREDENTIALS_UNSAFE]: The documentation for Step 6 advises the agent to run a command with an API key passed as an environment variable (ANTHROPIC_API_KEY=... node harness.mjs). This practice is insecure as environment variables in command lines can be captured in shell history, process logs, or system monitoring tools.
[REMOTE_CODE_EXECUTION]: The skill's verification process relies on running external scripts (harness.mjs, rescore.mjs) located in a separate repository checkout. Executing non-skill code based on external instructions poses a risk if the environment or source repository is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from RESOLVER.md and AGENTS.md files, which contain triggers and descriptions from multiple skills. Without sanitization, malicious content in these files could potentially influence the agent's behavior during the file rewriting process. Evidence: 1. Ingestion points: RESOLVER.md and AGENTS.md are read during the compression steps. 2. Boundary markers: No delimiters or ignore instructions are used for the ingested content. 3. Capability inventory: The skill uses exec, read, write, and edit tools. 4. Sanitization: No input validation or filtering of external content is specified.

functional-area-resolver