The Agent Skills Directory

[DYNAMIC_EXECUTION]: The documentation provides multiple code examples (in references/tool-builder.md and references/agent-patterns.md) that use the eval() function to process expression arguments from the LLM. This is an unsafe coding pattern that allows for arbitrary code execution within the host environment if the agent is manipulated. Additionally, the skill explicitly documents an internal_tools().code_execution(True) feature which grants the agent the ability to run code.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of agents that ingest untrusted data from various sources including web search results and file attachments. 1. Ingestion points: External data enters the agent context through web_search(True), agent.send_message with files, and the app_tool search integration. 2. Boundary markers: The provided examples do not demonstrate the use of delimiters or instructions to ignore embedded prompts in external content. 3. Capability inventory: The skill supports network operations via webhook_tool, file system operations (e.g., delete_file), and dynamic code execution. 4. Sanitization: There is no evidence of sanitization or validation of external content before it is processed by tools.
[DATA_EXFILTRATION]: The webhook_tool functionality enables agents to send data to arbitrary external HTTP endpoints. While intended for integrations like Slack, this creates a significant surface for exfiltrating sensitive data or credentials if the agent's instructions are subverted.
[COMMAND_EXECUTION]: The skill's platform configuration (allowed-tools) explicitly permits the agent to execute shell commands via Bash(python *), providing broad access to the execution environment.

python-sdk