The Agent Skills Directory

[COMMAND_EXECUTION]: The extensions/factory/validator.py script executes generated skill code and tests using subprocess.run(['uv', 'run', 'pytest', ...]). This execution happens on the host system without robust virtualization or container-based isolation, allowing potentially malicious code to run with the agent's privileges.
[REMOTE_CODE_EXECUTION]: The extensions/factory/core.py module uses an LLM to generate Python scripts from natural language requirements and writes them directly to the assets/skills/ directory. When combined with the automated validator and 'jit_install' capabilities, this creates a pipeline for executing code derived from untrusted input.
[PROMPT_INJECTION]: The extensions/factory/harvester.py script processes session history (untrusted data) to detect skill creation requests, which are then passed to the code generator without sanitization or boundary markers. Additionally, the SKILL.md file contains instructions labeled as [CRITICAL] and MANDATORY RULE designed to override the agent's default tool-calling logic.
[EXTERNAL_DOWNLOADS]: The data/known_skills.json file contains a list of skill identifiers linked to external GitHub repositories (e.g., github.com/omni-dev/skill-pandas). The skill.jit_install command is designed to fetch and activate these remote resources.
[DATA_EXFILTRATION]: The scripts/discovery.py tool returns metadata that includes absolute or relative local file paths for source code and documentation, exposing the system's directory structure. The scripts/templates.py module allows reading file contents via get_template_source based on user-supplied parameters.

skill