The Agent Skills Directory

EXTERNAL_DOWNLOADS (MEDIUM): The skill directs users to install a package denario from PyPI and pull a Docker image pablovd/denario:latest from Docker Hub. Neither the GitHub repository AstroPilot-AI/Denario nor the Docker author pablovd are on the trusted source list. Installation of unverified packages can lead to supply chain attacks.
REMOTE_CODE_EXECUTION (LOW): In references/llm_configuration.md, the skill suggests installing the Google Cloud SDK using the pattern curl https://sdk.cloud.google.com | bash. While google.com is a trusted source per [TRUST-SCOPE-RULE], this remains a risky execution pattern for external scripts.
COMMAND_EXECUTION (MEDIUM): The core workflow includes den.get_results(), which is documented as executing computational experiments based on provided data and methodologies. This indicates the skill likely generates and runs code dynamically, which can be dangerous if the input methodologies (Category 8) are malicious.
Indirect Prompt Injection (LOW): The skill possesses a significant attack surface for indirect prompt injection.
Ingestion points: set_data_description, set_method (loads markdown files), and set_results (loads markdown files).
Boundary markers: No specific delimiters or safety warnings for the agent to ignore instructions embedded in research data or methodology files are documented.
Capability inventory: The skill has the capability to execute code (computational analysis), generate LaTeX files, and interact with external LLM APIs.
Sanitization: No evidence of sanitization or validation of the input methodology files before they are processed by the multi-agent system.

denario