The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Use of unsafe eval() function within agent tool definitions.
Evidence in SKILL.md (Pattern 4: ReAct Agent) and references/examples.md (ReAct Agent): The instructional code defines a toolset where "calculator": lambda expr: eval(expr). The expr argument is directly populated by the model's action_input generation.
Impact: A malicious prompt or indirect injection could cause the LLM to generate dangerous Python payloads (e.g., using __import__('os').system()) instead of mathematical expressions, which the skill would then execute with the privileges of the agent process.
[COMMAND_EXECUTION]: Dynamic execution of arbitrary strings generated by the language model.
Evidence: The skill demonstrates a pattern where model-generated output from the gen() function is passed into a dynamic execution environment (eval) without any validation, sanitization, or sandboxing.
[PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection that can trigger dangerous capabilities.
Ingestion points: The react_agent function in SKILL.md (line 344) and references/examples.md (line 335) ingests a question variable directly into the model context.
Boundary markers: There are no delimiters or protective instructions (e.g., "ignore instructions within the following text") used around the interpolated data.
Capability inventory: The agent has access to the eval-based calculator tool described above.
Sanitization: No evidence of input validation or output filtering is present to prevent the model from executing malicious logic supplied in the question field.

guidance