The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is explicitly designed to execute arbitrary Python code provided via the code input parameter. While the documentation states this occurs in a safe sandboxed environment, this capability represents a high-impact operation where the agent acts as a proxy for script execution.
[COMMAND_EXECUTION]: The skill invokes the belt command-line interface via a shell environment to interact with the inference.sh platform. The allowed-tools configuration correctly restricts this access to the belt command prefix.
[EXTERNAL_DOWNLOADS]: The instructions direct users to install the belt-sh/cli tool using npx and reference external setup documentation hosted on GitHub. These resources are part of the primary infrastructure required for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection as it ingests and executes code derived from the agent's context.
Ingestion points: The code field in the input schema within SKILL.md accepts arbitrary strings for execution.
Boundary markers: There are no explicit instructions or delimiters provided to warn the agent about potentially malicious instructions embedded in the code it is asked to run.
Capability inventory: The environment includes powerful libraries for network access (requests, selenium, playwright), file system interaction within the sandbox (outputs/ directory), and data processing.
Sanitization: The skill relies entirely on the external platform's sandboxing logic; there is no local validation or sanitization of the Python code before it is passed to the shell.

python-executor