The Agent Skills Directory

[COMMAND_EXECUTION]: The SandboxedExecution pattern in skill.md recommends the use of subprocess.run(command, shell=True). Executing commands through a shell is a dangerous practice that can lead to shell injection vulnerabilities, especially when handling inputs that may originate from an LLM or external source.- [DYNAMIC_EXECUTION]: The MCPAgent architecture described in section 6.1 outlines a process where the agent generates Python code based on a description, writes it to a local file (server.py), and then dynamically loads and executes it. This "self-modifying" behavior for tool creation is a significant security risk as it provides a direct path for remote code execution if the generation process is influenced by malicious instructions.- [INDIRECT_PROMPT_INJECTION]: The skill documents architectural patterns for ingesting data from external URLs (requests.get) and browser automation (playwright), which are primary vectors for indirect prompt injection.
Ingestion points: ContextManager.add_url and BrowserTool.open_url in skill.md ingest content from arbitrary external sources.
Boundary markers: The prompt construction example in ContextManager.format_for_prompt uses simple Markdown headers that do not provide robust isolation between trusted instructions and untrusted data.
Capability inventory: The design includes high-privilege tools such as run_command, write_file, and edit_file that could be abused if the agent follows malicious instructions hidden in ingested data.
Sanitization: The patterns provided do not include any form of sanitization, validation, or escaping of external content before it is interpolated into the agent's prompt.- [DATA_EXFILTRATION]: The ContextManager uses the requests library to fetch data from arbitrary URLs. Without a restrictive domain whitelist, this pattern can be used to exfiltrate sensitive context or hardcoded secrets by sending them as parameters to an external, attacker-controlled endpoint.

autonomous-agent-patterns