The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill contains insecure code examples where LLM-generated content is executed directly using the Python eval() function.
Evidence: Found in SKILL.md (Pattern 4) and references/examples.md within the react_agent implementation: tools = {"calculator": lambda expr: eval(expr), ...}.
The input to eval() is generated by the agent (action_input), which can be manipulated by a user to execute arbitrary Python code, potentially leading to system compromise.
[INDIRECT_PROMPT_INJECTION]: The skill documentation establishes an architecture that is vulnerable to indirect prompt injection through its tool-use examples.
Ingestion points: User-provided question and potentially external search results in the react_agent function (found in SKILL.md and references/examples.md).
Boundary markers: Absent. The prompt interpolation does not use specific delimiters or instructions to prevent the model from following commands embedded within the input data.
Capability inventory: The agent examples have the ability to execute code via the eval() function provided in the toolset.
Sanitization: Absent. There is no validation or sandboxing of the action_input string before it is passed to the execution sink.
[COMMAND_EXECUTION]: By using eval(), the examples facilitate arbitrary command execution on the host environment if the LLM is tricked into generating expressions that use modules like os or subprocess (e.g., __import__('os').system(...)).

guidance