The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a default shell tool that uses child_process.exec to execute arbitrary commands on the host system.
Evidence: Found in langgraph-agent.js within the defaultTools object. The execute function for the shell tool takes a command argument and runs it via execAsync without any command validation or restricted environment.
[DATA_EXFILTRATION]: The built-in file_read and file_write tools provide unrestricted access to the local filesystem, allowing the agent to read sensitive files or modify system configurations.
Evidence: langgraph-agent.js contains implementations for file_read (using fs.readFile) and file_write (using fs.writeFile) that do not implement path sandboxing or directory traversal protection.
[PROMPT_INJECTION]: The agent framework is vulnerable to indirect prompt injection, where malicious content from a file or command output can manipulate the agent's behavior.
Ingestion points: Content retrieved via file_read and stdout/stderr from shell are appended directly to the conversation history in the AgentState within langgraph-agent.js.
Boundary markers: The skill does not use delimiters, XML tags, or system-level warnings to distinguish between tool-returned data and agent instructions.
Capability inventory: The agent possesses high-impact capabilities including arbitrary shell execution (shell), file reading (file_read), and file writing (file_write).
Sanitization: No sanitization, escaping, or validation is performed on the data returned by tools before it is passed back to the LLM for the next turn in the loop.

langgraph-agent