The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs complex shell strings by interpolating user-provided $ARGUMENTS and settings from CLAUDE.md directly into bash and SSH commands (e.g., ssh <server> ... python <script> <args>). This creates a significant command injection surface if inputs are not sanitized. It also involves dynamic modification of executable training scripts to inject Weights & Biases logging code.
[REMOTE_CODE_EXECUTION]: The skill is designed to execute code on remote servers. It syncs code via rsync or git and executes it in background screen sessions. It also performs remote dependency installation via pip install -r requirements.txt, which can be exploited to execute arbitrary code on the target server if the requirements file is malicious.
[DATA_EXFILTRATION]: The skill accesses sensitive local files including ~/.claude/feishu.json and vast-instances.json to retrieve configuration data and API keys (e.g., W&B API keys). Accessing files in the ~/.claude/ directory is considered sensitive file path access.
[EXTERNAL_DOWNLOADS]: The skill initiates external package downloads through pip install on remote instances based on the content of a project's requirements.txt file.
[PROMPT_INJECTION]: The skill's operational parameters are driven by CLAUDE.md, an external configuration file that might be under attacker control in shared or public repositories.
Ingestion points: CLAUDE.md and vast-instances.json (SKILL.md).
Boundary markers: None identified; parameters are used directly in command assembly.
Capability inventory: Extensive bash tool access, SSH remote execution, file modification, and network-based code syncing.
Sanitization: No evidence of input validation or escaping for the configuration values extracted from the project files.

run-experiment