The Agent Skills Directory

[COMMAND_EXECUTION]: The calculate function in SKILL.md and the CalculatorTool in scripts/simple_agent.py use the eval() function to process user-provided strings. While intended for mathematical expressions, eval() is a high-risk function that can lead to arbitrary code execution if the input is not perfectly sanitized.
[DATA_EXFILTRATION]: The api_call tool in SKILL.md allows the agent to make HTTP GET requests to arbitrary endpoints provided as strings. This pattern can be exploited for Server-Side Request Forgery (SSRF) or to exfiltrate data if an attacker influences the endpoint URL.
[REMOTE_CODE_EXECUTION]: The framework provides patterns for dynamic tool execution. Although the code_executor tool in assets/agent_config.yaml is disabled by default, the inclusion of eval()-based tools provides a functional equivalent for code execution.
[PROMPT_INJECTION]: As a framework for building agents that process external data (e.g., web search results), the skill is inherently susceptible to indirect prompt injection.
Ingestion points: Data enters the agent via search tool results and API responses processed in SKILL.md and scripts/simple_agent.py.
Boundary markers: The implementation code in scripts/simple_agent.py lacks explicit boundary markers or instructions to the LLM to ignore embedded instructions in tool outputs.
Capability inventory: The agent has the capability to execute code via eval and perform network operations via the requests library.
Sanitization: While the documentation mentions safe_tool_filter, the provided scripts do not implement robust sanitization of external content before it is re-interpolated into the agent's prompt.

agent-frameworks