The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes configuration data from external files located in the project workspace, which acts as a vulnerability surface for indirect instructions. * Ingestion points: Reads CLAUDE.md and vast-instances.json from the project root to extract server aliases, paths, environment variables, and GPU configurations. * Boundary markers: None. The skill does not implement delimiters or instruct the agent to ignore instructions embedded within these files. * Capability inventory: Uses Bash(*), Write, Edit, and ssh (via shell) to perform sensitive actions based on the ingested data. * Sanitization: No validation or sanitization is performed on values retrieved from these files before they are interpolated into shell commands.
[COMMAND_EXECUTION]: Shell commands are dynamically constructed using variables sourced from untrusted workspace files. * Evidence: The <server>, <conda_path>, and <script> variables extracted from CLAUDE.md are interpolated directly into ssh, rsync, and screen command strings, enabling potential command injection.
[DYNAMIC_EXECUTION]: The skill generates and modifies executable source code prior to runtime execution. * Evidence: Step 3.5 instructs the agent to modify existing training scripts by injecting wandb initialization and logging code via the Edit tool. * Evidence: Step 4 (Modal) generates a modal_launcher.py script which is subsequently executed using the modal run command.
[CREDENTIALS_UNSAFE]: The skill manages sensitive configuration and authentication information in potentially insecure ways. * Evidence: It reads notification settings from ~/.claude/feishu.json. * Evidence: It suggests retrieving a WANDB_API_KEY from CLAUDE.md for wandb login, which is a risky location for secrets as it may be committed to shared version control systems.

run-experiment