The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/auto_detect_candidates.py script accepts an optional --llm-ideas-cmd argument which allows for the execution of an arbitrary external command. This command is invoked using subprocess.run and receives JSON data via stdin. While shlex.split is used to prevent shell injection, the capability itself allows for arbitrary binary execution if the command string is influenced by an attacker.
[DYNAMIC_EXECUTION]: The scripts/validate_candidate.py script dynamically constructs a Python code snippet at runtime and executes it using uv run python -c. The snippet is used to perform validation against an external repository's schema. Although the script uses repr() to escape interpolated values like the strategy path and validation stage, the execution of runtime-generated code is a high-risk pattern.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external OHLCV files (Parquet), hint files (YAML), and news tables (CSV/Parquet). These files act as ingestion points for untrusted data. Descriptive fields such as 'observation', 'rationale', or 'hypothesis' could be used to embed malicious instructions. If the agent later reads these generated artifacts, it could be susceptible to indirect prompt injection.
[COMMAND_EXECUTION]: Multiple scripts, including scripts/validate_candidate.py and scripts/auto_detect_candidates.py, utilize subprocess.run to call external tools (uv, python, and user-defined commands). This reliance on subprocess calls to external binaries increases the potential impact of command injection if arguments are not strictly validated.

edge-candidate-agent