The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for ingesting untrusted data from external sources (web pages and URLs) and injecting them directly into the agent's context window.
Ingestion points: The ContextManager.add_url method uses the requests library to fetch content, and BrowserTool.get_page_content extracts text content from active browser sessions.
Boundary markers: The format_for_prompt implementation uses simple Markdown headers (e.g., '## URL:') to delimit content but lacks instructions or robust delimiters to prevent the agent from obeying commands embedded in the fetched data.
Capability inventory: The skill patterns include capabilities for file system modification (EditFileTool), arbitrary file reading (ReadFileTool), and shell command execution (SandboxedExecution).
Sanitization: The provided code snippets do not include sanitization, filtering, or validation logic for the external content before it is processed by the LLM.
[DYNAMIC_EXECUTION]: The MCPAgent.create_tool pattern describes an 'Add a tool' workflow where the agent requests the LLM to generate Python code for a new tool. This code is then written to the local filesystem and loaded into the environment. This pattern is highly susceptible to exploitation if the LLM's generation process is influenced by untrusted input.
[COMMAND_EXECUTION]: The SandboxedExecution.execute_sandboxed method uses subprocess.run with shell=True. Although it contains a validation check against a whitelist of base commands, executing strings in a shell environment remains a significant risk for command injection if the arguments are not perfectly sanitized.
[DATA_EXFILTRATION]: The skill defines tools that enable reading any file on the system via absolute paths (ReadFileTool) and sending network requests (ContextManager.add_url). Without strict path restrictions or network egress filtering, these patterns could be used to read sensitive credentials and transmit them to external servers.

autonomous-agent-patterns