The Agent Skills Directory

[Indirect Prompt Injection] (LOW): Documentation describes patterns for ingesting untrusted data through web endpoints and external storage, creating a potential surface for indirect prompt injection. Ingestion points: Web endpoints in references/web-endpoints.md and S3/Volume reads in references/examples.md. Boundary markers: Absent in provided examples. Capability inventory: Documents subprocess.run (references/gpu.md), run_commands (references/images.md), and persistent storage writes (references/volumes.md). Sanitization: Absent in provided examples.
[Unverifiable Dependencies & Remote Code Execution] (LOW): Examples demonstrate cloning repositories and executing subprocesses as part of the primary platform workflow. Evidence: references/images.md uses git clone from modal-labs and references/gpu.md uses subprocess.run. Trust Status: Sources are associated with the platform's official organization, reducing severity per [TRUST-SCOPE-RULE].
[Data Exposure & Exfiltration] (LOW): Documentation provides examples of mounting sensitive local directories like ~/.aws into containers. This is a documented feature for credential management within the platform's legitimate use cases.

modal