The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions direct the agent to "Write a temporary Python script for all checks" and execute it using uv run python or python3. This process of generating executable code at runtime to handle complex logic is a significant capability. If user-controlled input from $ARGUMENTS or discovered file metadata is incorporated into the script without proper escaping, it could lead to arbitrary code execution within the Python environment.
[COMMAND_EXECUTION]: The skill uses shell commands to resolve paths and execute the generated Python scripts. The $ARGUMENTS field allows users to specify directories and file names, creating a surface for command injection if the agent naively interpolates these strings into shell executions.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, potentially untrusted sources including .dta files and project documentation like README.md and AGENTS.md to identify structural requirements and potential anomalies.
Ingestion points: Files located in user-defined directories, project paths (e.g., ~/Dropbox/Github/[project]/), or specific file paths provided via arguments.
Boundary markers: There are no explicit instructions for the agent to treat data read from these files as untrusted or to use delimiters to prevent instructions within those files from influencing the agent's behavior.
Capability inventory: The skill possesses file-read, file-write (report generation), and subprocess execution (Python script) capabilities.
Sanitization: The instructions do not specify any sanitization, validation, or escaping logic for the content read from external files before it is processed or included in the final audit report.

pipeline-audit