The Agent Skills Directory

[COMMAND_EXECUTION]: The SandboxedExecution class uses subprocess.run with shell=True. The validation logic only verifies the primary command name, which permits the execution of unauthorized commands via shell operators like '&&' or ';' to bypass the restricted environment.\n- [REMOTE_CODE_EXECUTION]: The MCPAgent pattern involves generating Python code via an LLM based on user descriptions, writing that code to a local file, and executing it as an MCP server. This dynamic loading and execution of unvalidated code generated at runtime is a high-risk practice.\n- [PROMPT_INJECTION]: The ContextManager implementation creates a surface for indirect prompt injection. 1. Ingestion points: Untrusted data enters via add_file and add_url methods in SKILL.md. 2. Boundary markers: The format_for_prompt method lacks delimiters or specific instructions for the agent to ignore embedded commands. 3. Capability inventory: The skill defines high-risk tools for run_command, write_file, and edit_file. 4. Sanitization: No filtering or escaping is applied to the ingested content before prompt interpolation.\n- [EXTERNAL_DOWNLOADS]: The skill includes code for fetching remote content using the requests library, which allows the agent to pull data and potentially malicious instructions from arbitrary external URLs.

autonomous-agent-patterns