The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/analyze.sh file is vulnerable to Python code injection. The script uses a bash heredoc to dynamically generate and execute Python code, interpolating the $DATAFILE variable directly into a string literal: filepath = Path("$DATAFILE"). Because the heredoc is not quoted (e.g., << 'PYEOF'), bash expands the variable before the Python interpreter sees it. A malicious filename containing a closing quote and Python commands (e.g., data.csv"); import os; os.system("ls /") #) would result in the execution of arbitrary commands under the agent's privileges.
[EXTERNAL_DOWNLOADS]: The scripts/install_ydata.sh script downloads and installs the ydata-profiling and setuptools packages from the Python Package Index (PyPI) using uv. This is the intended behavior for the skill's setup process.

exploring-data