The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in README.md use curl -sL skil.sh | sh, which downloads a shell script from an external domain and pipes it directly into the shell for execution. This is a high-risk pattern that bypasses standard package management and oversight.
[DYNAMIC_EXECUTION]: The skill instructions (e.g., in SKILL.md and SPECIALIZED-3D-FORMATS.md) perform unsafe deserialization of local data files using the pickle module. If an attacker provides a maliciously crafted dataset file (e.g., a .pkl.gz annotation file), this could lead to arbitrary code execution within the agent's environment.
[UNVERIFIABLE_DEPENDENCIES]: Instructions for specialized formats (in SPECIALIZED-3D-FORMATS.md) recommend installing Python packages directly from GitHub (e.g., git+https://github.com/scaleapi/pandaset-devkit.git). Installing from raw source repositories rather than verified, version-pinned registry packages increases the risk of supply chain attacks.
[COMMAND_EXECUTION]: The skill relies heavily on shell commands (bash, find, ls, sed, xargs) and dynamic Python code generation to explore file systems and process multimodal data. This provides a broad execution surface that could be exploited if user-provided paths or filenames contain malicious characters.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function—scanning and ingesting data from arbitrary local folders and the Hugging Face Hub—creates a significant surface for indirect prompt injection.
Ingestion points: Local file system directories, Hugging Face Hub repository metadata, and file contents (e.g., fiftyone.yml, README.md).
Boundary markers: The instructions lack delimiters or warnings to prevent the agent from following instructions embedded within the data files being processed.
Capability inventory: The agent has the capability to execute shell commands, perform network requests (via Hugging Face Hub), and modify the local FiftyOne database.
Sanitization: There is no evidence of sanitization or validation of external data before it is processed or used to construct commands.
[PROMPT_INJECTION]: The SKILL.md file contains instructions to "Report errors minimally to user" and "Keep error messages simple for the user." This concealment pattern, while intended for user experience, can be used to hide the failure or presence of malicious operations from the user.

fiftyone-dataset-import