The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/classwise_iou_table.py contains a hardcoded absolute file path (/Users/bytedance/gitcode/paper_experiment_plot_skills/repro/classwise_iou_repro.png). This exposes specific details about the local environment, including a username and internal directory structure.
[COMMAND_EXECUTION]: The skill workflow in SKILL.md and references/reproduction_guide.md involves running shell commands (e.g., python3 -c "...") to analyze images and execute generated scripts. This is part of the skill's intended functionality but increases the local attack surface.
[DYNAMIC_EXECUTION]: The workflow describes a process of generating and iterating on Python scripts (Write script → python3 <script>.py). This runtime generation and execution of code is a core feature of the skill but carries risks if the generated code is influenced by untrusted inputs.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided images which may contain text instructions. The lack of sanitization or boundary markers creates a vulnerability where the agent could be manipulated by malicious text embedded in a figure.
Ingestion points: User-uploaded paper figures and screenshots.
Boundary markers: None present in the instructions to prevent the agent from following instructions found within the images.
Capability inventory: File system writing via matplotlib, image manipulation via Pillow, and shell execution capabilities.
Sanitization: No methods for sanitizing or filtering perceived text content from figures are provided.

plot-from-image