The Agent Skills Directory

[COMMAND_EXECUTION]: The run.js and benchmark.js scripts are designed to execute arbitrary code snippets via child_process.spawn. This includes support for /bin/bash and python3, granting the skill the ability to perform any action the host user is authorized to do.
[DYNAMIC_EXECUTION]: The eval.js script uses the new Function() constructor to evaluate JavaScript expressions provided as command-line arguments. While it attempts to implement a restricted global context, this mechanism remains a vector for dynamic code execution.
[PRIVILEGE_ESCALATION]: The run.js script provides an --env flag that accepts a JSON object to set environment variables for the child process. This capability can be used to inject dangerous variables such as LD_PRELOAD, NODE_OPTIONS, or PYTHONPATH to manipulate the behavior of the executed code or the runtime environment.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a high-privilege sink for agent instructions. An attacker could potentially use indirect injection to cause the agent to execute malicious code through these tools.
Ingestion points: Untrusted code input via the command-line argument or --stdin flag in run.js and eval.js.
Boundary markers: None identified; the skill assumes all provided input is intended for execution.
Capability inventory: Full file system access, shell execution, and environment variable manipulation.
Sanitization: Minimal; the code is written directly to temporary files in the system's temp directory before execution.

code-runner