The Agent Skills Directory

[DYNAMIC_EXECUTION]: The example code for the calculator tool in SKILL.md uses the Python eval() function on the expression parameter. Because this parameter is supplied by the LLM based on user input, an attacker could potentially execute arbitrary Python code by providing a malicious query that the LLM transforms into a harmful expression string.
[INDIRECT_PROMPT_INJECTION]: The skill architecture is designed to ingest untrusted user input into the agent's state (e.g., AgentState messages and RouterState queries in SKILL.md).
Ingestion points: User messages are appended to the state via the add_messages reducer in the agent node, and raw queries are processed in the classifier node.
Boundary markers: The provided code examples do not include boundary markers or system instructions to ignore embedded commands in the processed data.
Capability inventory: The skill provides capabilities for tool execution via ToolNode, including a tool with arbitrary code execution (eval), and conditional routing that changes agent behavior based on input content.
Sanitization: There is no evidence of input validation, filtering, or escaping of the user-supplied strings before they are processed by the LLM or tools.

langgraph