The Agent Skills Directory

COMMAND_EXECUTION (HIGH): The tools write_dofile, stata_do, and append_dofile (defined in SKILL.md and references/tools.md) grant the agent the ability to create and run arbitrary Stata code on the host system. This capability can be misused to execute malicious logic if the agent follows instructions from an untrusted source.\n- REMOTE_CODE_EXECUTION (HIGH): The ado_package_install tool (documented in references/tools.md) permits downloading and installing packages from external sources like GitHub or SSC. This allows the execution of unverified remote scripts on the user's machine.\n- PROMPT_INJECTION (HIGH): The skill is highly susceptible to Indirect Prompt Injection when processing external research data. Evidence Chain:\n
Ingestion points: get_data_info in references/tools.md ingests untrusted .dta and .csv files.\n
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the recommended system prompts in references/advanced.md.\n
Capability inventory: Includes write_dofile, stata_do, read_file, and ado_package_install.\n
Sanitization: No sanitization of ingested data before its use in do-files is specified, allowing data to influence code generation.\n- DATA_EXFILTRATION (MEDIUM): The read_file tool (documented in references/tools.md) can be used to access sensitive local files. An agent influenced by malicious input could be tricked into reading files such as SSH keys or environment variables and outputting their contents to the chat.

stata-sep