The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill attempts to install the hashid package from the Python Package Index (PyPI) at runtime if it is not already present.
[COMMAND_EXECUTION]: The skill executes the hashid command-line utility, passing the user-provided HASH_VALUE variable directly into a shell command string.
[DYNAMIC_EXECUTION]: The workflow generates and executes a Python script on the fly using a shell heredoc (PYEOF). User-controlled variables (PLAINTEXT and HASH_VALUE) are interpolated directly into the Python source code, which can lead to arbitrary code execution if the inputs contain quote-delimiters or Python commands.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The HASH_VALUE and PLAINTEXT variables are sourced from the agent's context and derived from user input.
Boundary markers: None. The data is interpolated directly into executable shell and Python contexts without delimiters or warnings to the interpreter.
Capability inventory: The skill has the ability to install packages (pip), execute shell commands (hashid), and run arbitrary Python code (python3).
Sanitization: There is no evidence of validation, escaping, or sanitization for the input variables before they are used in sensitive sinks.

hash-identify