The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Documentation in references/tool-builder.md and references/agent-patterns.md contains examples using eval() to process model-generated 'expression' arguments. This pattern is unsafe and could lead to arbitrary code execution if used without strict sanitization.- [COMMAND_EXECUTION]: The skill's allowed-tools in SKILL.md permit the execution of any Python command and package installation via pip. This grants the agent significant control over the local environment.- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the inferencesh package from PyPI, which is the vendor's own SDK.- [PROMPT_INJECTION]: The SDK handles data from various AI models and external apps, creating a surface for indirect prompt injection. Ingestion points include agent.send_message and client.run outputs, which are used to drive tool calls such as code_execution or webhook_tool without explicit sanitization documented in the examples.

python-sdk