The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it retrieves untrusted data from multiple sources and interpolates it into a high-reasoning LLM prompt without sanitization.
Ingestion points: Data is collected from training logs (via SSH), Weights & Biases (W&B) run history, and local files like EXPERIMENT_LOG.md and EXPERIMENT_TRACKER.md (found in SKILL.md).
Boundary markers: The prompt template for the Codex evaluation tool lacks explicit boundary markers or delimiters to separate instructions from the potentially untrusted experimental data.
Capability inventory: The skill has access to powerful tools including Bash (allowing for network and remote execution), Write, and Edit (allowing for file system modification).
Sanitization: There is no evidence of data sanitization or validation before the external content is processed by the LLM.
[COMMAND_EXECUTION]: The workflow explicitly instructs the agent to execute commands on remote servers using SSH (ssh server "tail -100 /path/to/training.log") to retrieve log files. While intended for data collection, this pattern represents an interaction with external infrastructure that could be abused if parameters are influenced by malicious input.

result-to-claim