The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's README.md documentation recommends an installation method that uses curl -sL skil.sh | sh to download and execute a script from an external domain. This pattern is inherently dangerous as it executes unverified remote code with the user's local privileges.
[EXTERNAL_DOWNLOADS]: The SKILL.md file contains directives to download and enable external plugins from the voxel51/fiftyone-plugins GitHub repository using functions like download_plugin. This allows the skill to dynamically extend its functionality by fetching and running code from a remote source.
[COMMAND_EXECUTION]: The skill instructs the agent to execute various system and application-level commands, including operator execution via execute_operator and managing application sessions with launch_app and close_app.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from dataset fields (e.g., model predictions and ground truth annotations) which could be used to influence the agent's behavior.
Ingestion points: Data is ingested from dataset fields in SKILL.md via the execute_operator (specifically parameters like pred_field and gt_field) and through Python SDK calls like fo.load_dataset().
Boundary markers: The instructions do not define boundary markers or provide directives to the agent to ignore any potential instructions embedded within the dataset samples.
Capability inventory: The skill has access to sensitive capabilities including plugin management (download_plugin, enable_plugin), operator execution, and application control.
Sanitization: There is no evidence of sanitization or schema validation performed on the contents of the label fields before they are processed by the evaluation logic.

fiftyone-model-evaluation