The Agent Skills Directory

[DYNAMIC_EXECUTION]: The calculate tool in templates/custom-mcp-server.ts uses eval() to process user-provided strings for mathematical calculations. This pattern facilitates arbitrary code execution if the agent is directed to process a malicious expression.
[COMMAND_EXECUTION]: The skill provides numerous templates and references, such as templates/subagents-orchestration.ts and references/permissions-guide.md, that demonstrate autonomous Bash tool usage, enabling agents to execute shell commands directly.
[INDIRECT_PROMPT_INJECTION]: The skill defines ingestion points for external data via tools like Read, Grep, and Glob in templates/query-with-tools.ts, creating a surface for indirect prompt injection. The templates lack explicit boundary markers or sanitization for prompt interpolation of this external data, though SKILL.md documents an issue regarding Unicode line separator sanitization in tool results.
[EXTERNAL_DOWNLOADS]: The scripts/check-versions.sh script fetches package metadata from the NPM registry. The skill also recommends installation of official SDK packages from the trusted anthropic-ai organization.

claude-agent-sdk