The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/package_submission.py contains a verify_runtime function that executes arbitrary shell commands using subprocess.run. These commands are supplied via the --verify-command argument during the execution of the skill. While intended for reproduction verification, this allows for the execution of any command provided through the skill's interface.
[DYNAMIC_EXECUTION]: The assemble function in scripts/package_submission.py uses the compile() function to check the syntax of Python files being packaged. Although the resulting code object is not explicitly executed with exec(), the use of compile() on potentially untrusted workspace files is a dynamic execution sink that may be vulnerable to malicious source code designed to crash or exploit the compiler.
[INDIRECT_PROMPT_INJECTION]: The skill's auditing logic in passed_audit and gate_evidence rely on searching for specific strings (e.g., 'Verdict: PASSED') within Markdown and JSON files in the workspace. An attacker with the ability to modify workspace files could inject these strings to bypass the required G6 gates and security audits. Ingestion points: Reads paper/audits/cross_media_consistency_audit.md, paper/audits/completeness_audit.md, paper/qa_report.md, planning/manifests/Qx.json, and decision ledgers (*.jsonl). Boundary markers: None identified; the script performs simple regex searches and JSON field checks. Capability inventory: Includes the ability to execute shell commands (subprocess.run), compile Python code (compile), and write files to the filesystem. Sanitization: Uses shlex.split for command parsing and pathlib's is_relative_to for path validation, providing some protection against path traversal and command injection, but not preventing the execution of the commands themselves.

submission-packager