The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from untrusted external sources like web search results and MCP servers into the agent context. This creates a surface for indirect prompt injection where external content could attempt to influence agent behavior.
Ingestion points: WebSearchTool, WebFetchTool, and MCPServerTool documented in SKILL.md ingest external web and API content.
Boundary markers: The provided code recipes do not demonstrate explicit prompt delimiters or "ignore instructions" warnings for the retrieved content.
Capability inventory: The skill enables powerful capabilities including CodeExecutionTool and FilesystemToolkit (which are mitigated by recommended sandboxing).
Sanitization: Explicit data sanitization is not covered in the implementation recipes.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing well-known Python packages (such as exa-py) and framework-specific extras (ag2[ddgs], ag2[tavily]). These are standard dependencies for the search functionalities described.
[COMMAND_EXECUTION]: The skill documents the integration of the CodeExecutionTool and SkillsToolkit, which allow the agent to run code or scripts. The documentation for FilesystemToolkit includes security-positive instructions for using base_path sandboxing and read_only modes to prevent unauthorized file access or path traversal attacks.

ag2-use-builtin-tools