The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides a framework for building agents that ingest external data and possess significant capabilities, creating a potential surface for indirect prompt injection attacks.
Ingestion points: User-provided messages in agent.send_message() (found in SKILL.md) and external data retrieved through the web_search internal tool (found in references/tool-builder.md).
Boundary markers: The provided documentation examples do not demonstrate the use of delimiters or specific instructions to ignore embedded commands in processed data.
Capability inventory: The SDK supports powerful capabilities including code_execution(True) (found in references/agent-patterns.md), arbitrary command execution via the Bash(python *) allowed-tool, and the creation of webhook_tool instances for external API interactions.
Sanitization: There is no evidence of input sanitization or validation in the provided tool implementation examples.
[DYNAMIC_EXECUTION]: Documentation examples in references/tool-builder.md suggest the use of the Python eval() function to implement a calculator tool. While this is provided as a simplified implementation example for developers, it demonstrates a pattern that could lead to arbitrary code execution if user-provided strings are passed to the tool without strict validation.

python-sdk