The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation and reference files provide multiple implementation examples that use eval(call.args.expression) to process tool calls. This pattern allows for arbitrary code execution if the agent is prompted to generate malicious mathematical expressions or logic snippets.
[DYNAMIC_EXECUTION]: The skill documents the use of internalTools().codeExecution(true), which explicitly enables the AI agent to generate and execute code within its runtime environment. This is a high-privilege capability that should be used with caution.
[EXTERNAL_DOWNLOADS]: The skill instructs users to add remote skills via npx skills add for tools like belt-sh/cli and various platform-specific components (e.g., @python-sdk, @infsh-cli). It also demonstrates fetching configuration and documentation from external URLs.
[INDIRECT_PROMPT_INJECTION]: The SDK architecture presents a significant attack surface for indirect prompt injection.
Ingestion points: External data enters the agent context through agent.sendMessage and outputs from tools such as appTool or webhookTool.
Boundary markers: The provided examples lack recommended delimiters or instructions to treat tool outputs as untrusted content.
Capability inventory: The agents built with this SDK typically have access to command execution (eval), runtime code generation, and network requests (webhookTool).
Sanitization: Although the requireApproval() method is available for tools, several examples demonstrate direct execution of dynamic content without validation or human oversight.

javascript-sdk