The Agent Skills Directory

[DYNAMIC_EXECUTION]: The file references/alignment_viewer_build.py contains a function _load_viewer_core that dynamically searches parent directories for a file named viewer_core.py, validates its content structure using the ast module, and then executes it using importlib.util.module_from_spec. This dynamic loading from computed/relative paths is a significant execution risk that can be exploited by placing a malicious script in the search path.
[DYNAMIC_EXECUTION]: The script references/alignment_viewer_extract.py manipulates the Python environment by calling sys.path.insert(0, r"<tmp>\armorhneck_research_ws\tools"). This allows the script to prioritize loading modules from a temporary directory, which could lead to module hijacking if that directory is writable by other users or processes.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection by processing untrusted complex data formats.
Ingestion points: references/alignment_viewer_extract.py and references/apply_alignment_json.py read and parse .p3d binary files.
Boundary markers: Absent; the data is processed directly without delimiters or instruction-bypass warnings.
Capability inventory: The skill scripts have capabilities to write/copy files (shutil.copy2), modify binary model data, and execute Blender commands.
Sanitization: Absent; no validation or sanitization is performed on the binary model metadata or geometry data before it is processed by the agent's logic.
[COMMAND_EXECUTION]: Several components, specifically references/export_clothing_fbx.py and the procedures in references/autofit-from-official-rig.md, rely on the automation of the Blender (bpy) environment. This provides high-privilege primitives for local command execution and file system manipulation under the guise of 3D modeling tasks.

dayz-clothing