The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the deepagents package and several LangChain-related dependencies from public registries via pip and uv. It also references the uv installer from astral.sh.\n- [REMOTE_CODE_EXECUTION]: The scripts/setup.sh file includes a command to download and execute a script from https://astral.sh/uv/install.sh by piping it directly to the shell (curl | sh). While the source is a well-known service, this pattern remains a high-risk execution vector.\n- [COMMAND_EXECUTION]: The skill exposes a powerful execute tool that allows the AI agent to run arbitrary shell commands on the host system. Additionally, the scripts/setup.sh script executes local shell commands to validate the Python environment and install packages.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It possesses a significant attack surface by combining data ingestion tools with high-privilege capabilities:\n
Ingestion points: The agent reads external data using read_file, ls, glob, and grep (found in SKILL.md).\n
Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between system instructions and untrusted content from files.\n
Capability inventory: The agent has access to execute, write_file, and edit_file tools (found in SKILL.md and references/deepagents-api.md).\n
Sanitization: No sanitization or validation logic is defined for the content read from the filesystem before it is processed by the model. Maliciously crafted files could contain instructions that trigger unauthorized shell commands or file modifications.

deepagents