The Agent Skills Directory

[DYNAMIC_EXECUTION]: The SKILL.md file contains TypeScript implementation examples for validateExpressionSyntax and testExpression that use the new Function constructor to dynamically evaluate strings as code. While intended for testing n8n expressions, this pattern is a form of dynamic execution that can be exploited if the input expressions are not strictly sanitized.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external n8n expressions and evaluate them using the dynamic execution capabilities mentioned above.
Ingestion points: The expression parameter in the testExpression and validateExpressionSyntax functions defined in SKILL.md.
Boundary markers: The logic includes basic removal of n8n template markers ({{ and }}) but does not implement robust isolation for the execution context.
Capability inventory: The skill leverages dynamic JavaScript execution (new Function) to process inputs.
Sanitization: The skill provides guidelines to scan for dangerous functions (like eval) within the expressions it tests, which serves as a security control, though the testing logic itself utilizes similar dynamic execution patterns.

n8n-expression-testing