The Agent Skills Directory

[COMMAND_EXECUTION]: The example script examples/typescript/src/document-pipeline.ts implements a document processing pipeline that reads local files based on a path property provided directly in mesh events (event.data.path). This script lacks path sanitization or validation, which could allow an attacker on the mesh to perform unauthorized local file reads or path traversal attacks.
[REMOTE_CODE_EXECUTION]: Documentation examples in examples/cross-org/README.md and other guides demonstrate the use of piping curl output from a local NATS monitoring port into a python3 interpreter (specifically python3 -m json.tool). While used locally for JSON formatting, this pattern is flagged for interpretation risk as it involves piping potentially unvalidated data into a code interpreter.
[EXTERNAL_DOWNLOADS]: The skill instructions facilitate the download and installation of several external dependencies and SDKs from public registries like npm and PyPI. All referenced libraries, including those for NATS, Anthropic, and OpenAI, originate from established and trusted organizations.
[SAFE]: Various setup scripts and credential examples, such as examples/cross-org/setup.sh, contain hardcoded dummy JWTs and NKey seeds. These are explicitly documented as placeholder values for demonstration purposes and do not represent a real-world credential exposure.

synapse