The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides examples of a calculator tool that uses the JavaScript eval() function to execute code based on LLM-generated strings.
Evidence in examples/agents.md: The calculator tool is defined as async ({ expression }) => { return String(eval(expression)); }.
Evidence in examples/structured-output-tools.md: The same tool pattern is repeated with the logic return String(eval(expression));.
Security Risk: An attacker can use prompt injection to trick the LLM into generating a malicious JavaScript payload (e.g., code to terminate the process or access the file system), which the eval() function will then execute with the agent's privileges.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for Retrieval-Augmented Generation (RAG) that process data from external, untrusted sources.
Ingestion points: examples/rag.md shows CheerioWebBaseLoader fetching content from web URLs and loaders for text and PDF files.
Boundary markers: The examples/rag.md file includes a "Prompt Injection Defense" section that uses system prompt instructions to separate context from instructions, though this is a probabilistic defense.
Capability inventory: The skill's agent patterns include tools for code execution (eval) and web search, which increases the impact if an injected instruction is followed by the model.
Sanitization: There is no evidence of automated content sanitization or filtering beyond basic prompt instructions.
[EXTERNAL_DOWNLOADS]: The skill documents how to fetch and process remote content from the internet.
In examples/rag.md, the code examples use CheerioWebBaseLoader to load data from https://example.com/blog-post. This allows the agent to communicate with and ingest data from non-whitelisted external domains.

ai-orchestration-langchain