The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides multiple examples in SKILL.md and references/agents.md of creating a 'Calculator' tool that uses the Python eval() function on strings provided by the LLM. This allows for arbitrary code execution if the LLM is manipulated by a user or external data.
[COMMAND_EXECUTION]: The integration guide in references/integration.md describes using ShellTool and PythonREPLTool. These tools grant the AI agent the ability to execute arbitrary shell commands and Python code on the host system, representing a high-privilege execution environment that requires strict isolation.
[DYNAMIC_EXECUTION]: In references/integration.md, the FAISS vector store example explicitly enables allow_dangerous_deserialization=True. This allows for arbitrary code execution when loading a vector store index from an untrusted source, as it uses the pickle module internally.
[INDIRECT_PROMPT_INJECTION]: The skill documents an extensive ingestion surface alongside high-capability execution tools.
Ingestion points: WebBaseLoader, PyPDFLoader, GithubFileLoader, DuckDuckGoSearchRun, and WikipediaQueryRun process untrusted external content in SKILL.md and references/rag.md.
Boundary markers: No explicit instructions or delimiters for isolating external data from system instructions are provided in the examples.
Capability inventory: The skill documentation enables access to ShellTool, PythonREPLTool, eval(), and SQL database interactions across its reference files.
Sanitization: No input validation or sanitization of retrieved context is demonstrated before passing it to the LLM.

langchain