The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads an external library from an untrusted source (github.com/moojink/robocasa-cosmos-policy.git) as a primary dependency for its RoboCasa evaluation workflow.
[REMOTE_CODE_EXECUTION]: Code from the untrusted repository is installed and executed on the host system using uv pip install -e and python -m robocasa.scripts.setup_macros. This pattern grants the external code execution privileges within the user's environment.
[DYNAMIC_EXECUTION]: The evaluation workflow relies on loading T5 text embeddings from .pkl files (e.g., libero_t5_embeddings.pkl). Python's pickle module is inherently unsafe as it allows for arbitrary code execution during deserialization if a file is maliciously crafted or replaced.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted external data that directly influences the agent's behavior and control logic in simulation environments.
Ingestion points: Processes external dataset statistics (.json) and text embeddings (.pkl) specified via path arguments in SKILL.md.
Boundary markers: No delimiters or safety instructions are provided to the agent to distinguish between valid data and embedded instructions within these files.
Capability inventory: The skill possesses extensive capabilities including shell command execution (uv run, srun), file system writes for configuration, and network operations for asset downloads.
Sanitization: There is no evidence of validation or sanitization for the ingested statistics or embeddings before they are interpolated into the evaluation scripts.

evaluating-cosmos-policy