The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to clone a repository from an untrusted GitHub account (LanceZPF) and execute multiple Python scripts, including scripts/run_id.py and scripts/run_acrouter_ood176.py, which constitutes execution of code from an unverifiable source.
[DYNAMIC_EXECUTION]: The skill implements an agentic routing workflow that generates code and executes it at runtime using tools like pytest to verify solutions, which involves running dynamically generated content from untrusted task prompts.
[COMMAND_EXECUTION]: The skill documentation provides examples of using subprocess.run to execute external commands such as pytest on generated code, which can be manipulated to execute arbitrary shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes external coding prompts and automatically executes the resulting code via a verifier function without isolation or sanitization. 1. Ingestion points: Task prompts are ingested from task dictionaries or external files. 2. Boundary markers: No delimiters or instructions are used to separate task data from instructions. 3. Capability inventory: The verifier logic uses subprocess calls to execute code generated by the LLM. 4. Sanitization: There is no evidence of sanitization, sandboxing, or safety checks for the executed code.

agent-as-a-router-coding