The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting local Python scripts (.py) and Jupyter notebooks (.ipynb) and executing them on a remote Google Colab VM. This creates a vulnerability surface where malicious code within untrusted local project files could be executed on remote infrastructure.
Ingestion points: Commands such as colab exec -s <name> -f <script.py>, colab run script.py, and notebook execution via colab exec -f nb.ipynb are documented in SKILL.md for processing local data.
Boundary markers: The instructions lack guidance on using delimiters or providing 'ignore' instructions to prevent the agent from obeying malicious commands embedded in these files.
Capability inventory: The colab tool provides full shell access (colab console), arbitrary Python execution (colab exec), and file system operations on the remote VM, providing significant capability to an attacker.
Sanitization: The skill does not describe any validation or sanitization steps to be performed on local file content prior to its execution on the remote VM.
[REMOTE_CODE_EXECUTION]: The core functionality of the skill is to facilitate remote code execution on external Google Colab infrastructure. It provides commands to provision VMs (including GPU/TPU types) and execute local scripts remotely.
[COMMAND_EXECUTION]: The skill provides numerous examples of shell command execution, including tool installation with uv tool install, credential setup with gcloud auth, and session management subcommands. It also demonstrates piping code to the CLI for remote execution.
[DATA_EXFILTRATION]: The skill documents paths to sensitive files used for authentication and state management, specifically ~/.config/colab-cli/token.json and ~/.config/colab-cli/sessions.json. Accessing these paths could result in the exposure of session tokens or identity information.
[EXTERNAL_DOWNLOADS]: The skill recommends installing the google-colab-cli package from the Python Package Index (PyPI).

colab-operator