The Agent Skills Directory

[DYNAMIC_EXECUTION]: The documentation in references/tool-builder.md provides code examples (for tool handlers) that utilize eval() to process mathematical expressions derived directly from tool arguments. Since these arguments are generated by an LLM (the agent), this pattern is vulnerable to remote code execution if the agent is manipulated into generating malicious code strings instead of simple math.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of agents that are vulnerable to indirect prompt injection through common developer patterns it documents.
Ingestion points: references/agent-patterns.md describes a Retrieval-Augmented Generation (RAG) pattern utilizing external search tool output (tavily/search-assistant@latest) to inform agent responses, importing untrusted web content into the context.
Boundary markers: Examples in references/agent-patterns.md and SKILL.md show simple interpolation of user and system prompts but do not demonstrate the use of robust delimiters or specific instructions to treat external data as untrusted.
Capability inventory: Use of the SDK allows creation of agents with extensive capabilities, including file system access (e.g., the delete_file tool example), execution of arbitrary webhooks, and general code execution (internalTools().codeExecution(true)).
Sanitization: The provided examples do not include logic for sanitizing, escaping, or validating external content before it is processed by the AI models.
[EXTERNAL_DOWNLOADS]: SKILL.md recommends and provides commands to install external logic via npx skills add belt-sh/cli and various other inference-sh/skills. These commands download and integrate external code into the user's environment.
[COMMAND_EXECUTION]: The skill's allowed-tools configuration is broad, granting access to npm, npx, node, pnpm, and yarn. While expected for an SDK, this provides a vast attack surface if the agent's instructions are subverted.

javascript-sdk