The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides an execute tool via the FileSystem middleware and DeepAgent components, allowing the agent to run arbitrary shell commands. When used with the local filesystem backend, these commands are executed directly on the host system.
[REMOTE_CODE_EXECUTION]: The architecture allows the agent to reason and call tools based on user input. Providing a shell execution tool creates a direct vector for remote code execution if the agent is induced to run malicious commands.
[DATA_EXFILTRATION]: The FileSystem middleware includes tools like read_file, write_file, and grep, which give the agent broad access to the filesystem. If the root directory is not strictly controlled, this could be exploited to read sensitive credentials or configuration files.
[INDIRECT_PROMPT_INJECTION]: The agent ingests data from external files through read_file, grep, and specialized middleware like Agents.md and Skill. The evidence chain shows: (1) Ingestion points: File reading and metadata loading; (2) Boundary markers: Absent in documentation; (3) Capability inventory: Shell execution and filesystem write access; (4) Sanitization: No documented filtering or validation of ingested content. This combination makes the agent vulnerable to instructions hidden within local files.

eino-agent