The Agent Skills Directory

[DYNAMIC_EXECUTION]: The MCPAgent class implements a create_tool pattern that generates Python code via an LLM based on user-provided descriptions. This code is written directly to the filesystem (e.g., ./mcp_servers/server.py) and dynamically loaded/executed via a connect_server method. This pattern facilitates the execution of unverified code generated at runtime.
[REMOTE_CODE_EXECUTION]: The combination of LLM-generated code and filesystem persistence in the MCPAgent.create_tool method creates a pathway for remote code execution if the input description or the LLM's output is influenced by an attacker.
[INDIRECT_PROMPT_INJECTION]: The ContextManager class demonstrates a pattern for ingesting external data from files (add_file, add_folder) and URLs (add_url) and interpolating it directly into the agent's prompt using the format_for_prompt method.
Ingestion points: ContextManager.add_file, ContextManager.add_url, and ContextManager.add_folder in SKILL.md.
Boundary markers: The pattern uses markdown code blocks (```) to delimit content, but lacks explicit instructions to the LLM to ignore potentially malicious directives embedded within the ingested data.
Capability inventory: The skill patterns include capabilities for run_command, write_file, edit_file, and browser automation (open_browser, click_element).
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external content before it is interpolated into the system prompt.
[COMMAND_EXECUTION]: The SandboxedExecution class utilizes subprocess.run with shell=True to execute shell commands. While it implements a command whitelist (allowed_commands), the use of shell=True remains a high-risk pattern that could be vulnerable to command injection if argument parsing or whitelist validation is bypassed.

autonomous-agent-patterns