The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/profiler.py file includes an exec() call in the profile_code_block method (line 103). This allows for the execution of arbitrary Python code passed as a string. If the code_input parameter in SKILL.md is populated with attacker-controlled content, it enables remote code execution.
[COMMAND_EXECUTION]: The scripts/load_tester.py and scripts/profiler.py scripts are designed to execute arbitrary Python callables provided to them. This capability allows the agent to run any provided logic in the execution environment.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes external code and URLs via the code_input parameter without sanitization. Ingestion points: The code_input parameter in SKILL.md. Boundary markers: None identified. Capability inventory: Python code execution via exec(), system resource access via psutil, and network access via the requests library. Sanitization: No validation or filtering is applied to the input code before execution.

performance-optimization