The Agent Skills Directory

Command Execution Capabilities: The skill includes documentation for InvokeAgentRuntimeCommand, which allows developers to execute shell commands within a live agent session.
This feature is intended for devops and development workflows, such as running builds or tests.
The documentation provides explicit security guidance, advising developers to isolate IAM permissions and warning about potential command injection surfaces if user input is not properly sanitized.
Network and Resource Interaction: The skill includes a payment tool (x402_fetch) that performs external network requests to handle microtransactions.
A potential security consideration with network-facing tools is Server-Side Request Forgery (SSRF).
The provided tool includes a security best practice: a validation function that blocks requests to private, loopback, or internal IP ranges, effectively mitigating SSRF risks.
Official Tooling and External Dependencies: The skill references several external resources, including the installation of the @aws/agentcore CLI and various official SDK packages (e.g., bedrock-agentcore, strands-agents).
These are standard developer tools provided by the vendor and well-known partners (such as Privy) to support the skill's features.
The skill provides clear instructions for using these tools within the AWS security model, such as utilizing Secrets Manager for credential storage.
Input Processing Security: The skill documentation identifies areas where untrusted data (such as merchant responses or user prompts) enters the agent's context.
It includes remediation guidance, such as recommending the use of UUIDs for session management and providing validation patterns for protocol-specific headers.

agents-build