The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill framework documents the creation of agents that process untrusted user input, which creates an inherent attack surface for indirect prompt injection.
Ingestion points: The 'messages' key in the State dictionary receives untrusted content from users across multiple reference files (see SKILL.md and references/00-overview.md).
Boundary markers: While the documentation references role-based message structures (user vs. system), it does not detail robust input sanitization within the provided implementation templates.
Capability inventory: The system supports execution of arbitrary Python logic in graph nodes and tool execution via ToolNode, enabling significant system interaction (see references/01-graph-api.md and references/08-tool-integration.md).
Sanitization: Documentation recommends using 'recursion_limit' settings and 'safe evaluators' for tool logic to mitigate potential execution risks.
[DYNAMIC_EXECUTION]: Documentation examples illustrate the use of eval() for implementing mathematical tool logic (see references/08-tool-integration.md), which involves the dynamic execution of string input.
[METADATA_POISONING]: The skill's description metadata includes instructions ('When in doubt... use it') intended to influence the agent's selection process and ensure the skill is utilized for a broad range of tasks.
[EXTERNAL_DOWNLOADS]: The skill's installation instructions and maintenance scripts (scripts/check-updates.py) reference and fetch metadata from the official Python Package Index (pypi.org), which is a well-known and trusted service.

langgraph