The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Unsafe deserialization is present in scripts/incident_artifact_tool.py and scripts/replay_trusted_request_dump.py via the pickle.load() function. This operation allows for arbitrary code execution if a maliciously crafted pickle file is processed. The skill's documentation acknowledges that these tools are intended for "trusted" data and are designed to bypass standard safety unpicklers.
[COMMAND_EXECUTION]: The skill instructions (SKILL.md) and reference guides (references/replay-trace-profile.md) direct the agent to execute multiple shell commands. These include running the provided Python scripts, using curl to interact with API endpoints, and utilizing git bisect for regression testing. This heavy reliance on shell execution creates a surface for command injection if input parameters are influenced by untrusted data.
[DATA_EXFILTRATION]: scripts/incident_artifact_tool.py performs network requests using the urllib.request module to collect server diagnostic information from a user-provided --base-url. While intended for local triage, this capability could be used to exfiltrate data to an external, attacker-controlled endpoint if the base URL is manipulated.
[PROMPT_INJECTION]: The skill contains explicit instructions to bypass the safe_pickle_load safety filter of the official SGLang tools by using the provided scripts/replay_trusted_request_dump.py. This encourages the circumvention of established security constraints.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests data from potentially untrusted server endpoints and local file system artifacts.
Ingestion points: scripts/incident_artifact_tool.py (API endpoints and .pkl files) and scripts/replay_trusted_request_dump.py (external .pkl files).
Boundary markers: No boundary markers or "ignore embedded instructions" warnings are used for the processed data.
Capability inventory: The agent is instructed to perform shell command execution, network requests, and file system interactions across all scripts.
Sanitization: No sanitization or validation is performed on the deserialized objects from the dump files, increasing the risk that malicious data could influence the agent's logic.

sglang-prod-incident-triage