The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts scripts/incident_artifact_tool.py and scripts/replay_trusted_request_dump.py use the pickle.load() function to process diagnostic files. This is a well-known unsafe deserialization pattern that allows for arbitrary code execution if the input file is malicious.
Evidence: scripts/replay_trusted_request_dump.py explicitly states in its docstring that it uses 'plain pickle loading to bypass SafeUnpickler restrictions' which were implemented to prevent these exact security risks.
Evidence: The functions load_dump_payload and load_records both open and load binary data using pickle.load() without any integrity verification or sandboxing.
[COMMAND_EXECUTION]: The skill provides instructions to run these Python scripts against local files (e.g., python3 scripts/incident_artifact_tool.py summarize-dump --input-file /path/to/crash_dump.pkl). If a user or an agent is tricked into analyzing a malicious pickle file provided by an external source, it will lead to immediate code execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize data from SGLang servers and diagnostic dumps.
Ingestion points: scripts/incident_artifact_tool.py performs network requests to various SGLang endpoints (/metrics, /server_info, /v1/loads) and processes the responses. Both scripts also read binary .pkl files.
Boundary markers: There are no delimiters or warnings for the agent to ignore instructions that might be embedded in the diagnostic data.
Capability inventory: The skill allows the agent to execute shell commands, perform network operations, and read/write files in /tmp.
Sanitization: The skill does not perform validation on the contents of the diagnostic data before processing it or displaying summaries to the user.

sglang-prod-incident-triage