The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes a code snippet for a custom "Calculator" tool that uses the Python eval() function to evaluate user-provided expressions.
Evidence: Found in the "Custom Tools" section of SKILL.md within the calculate function definition.
Risk: Implementing eval() on untrusted user or model-generated input creates a remote code execution (RCE) vulnerability, allowing an attacker to execute arbitrary commands within the environment.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates workflows that ingest data from untrusted external sources, creating an attack surface for indirect prompt injection.
Ingestion points: SKILL.md shows examples where data from search_web() and user-provided math_problem strings are stored in the agent's state.
Boundary markers: The provided prompt templates lack explicit delimiters or instructions to ignore embedded commands when processing retrieved content.
Capability inventory: The demonstrated nodes have access to network tools, database savers (PostgreSQL/SQLite), and tool execution functions.
Sanitization: There is no evidence of filtering or sanitization of content retrieved from search tools before it is interpolated into LLM prompts.

langgraph