The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local bash scripts (launch_gpu.sh and launch_tpu.sh) and uses the sky (SkyPilot) CLI tool to manage clusters and execute jobs. Local shell commands are constructed by concatenating user-provided inputs such as accelerator types, script paths, and arguments.
[REMOTE_CODE_EXECUTION]: The primary function of the skill is to run arbitrary Python code on remote infrastructure. The sky exec command template in SKILL.md allows the execution of any script path provided by the user on the provisioned remote cluster.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect injection because it ingests untrusted user data (accelerator types, script paths, arguments) and interpolates them directly into shell commands.
Ingestion points: User-provided arguments for accelerator_type, script-path, and args in the exec-remote command.
Boundary markers: None. User input is placed directly into shell strings inside SKILL.md and the bash scripts.
Capability inventory: The skill has the ability to run local shell scripts, write to the file system (creating .cluster_name_* files and temporary YAMLs), and execute arbitrary code on remote clusters via sky exec.
Sanitization: While the NAME parameter is sanitized using a regex in the bash scripts, the ACCELERATOR parameter and the script paths/args used in sky exec are not sanitized, leaving the system open to command breakout or manipulation.
[DYNAMIC_EXECUTION]: The scripts launch_gpu.sh and launch_tpu.sh use sed to dynamically modify YAML configuration files (gpu_resource.sky.yaml and tpu_resource.sky.yaml) at runtime. The use of sed with the | delimiter and unsanitized variables (like $ACCELERATOR) allows an attacker to manipulate the resulting YAML file structure.

exec-remote