The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents the run_command tool, which allows agents to execute shell commands. However, it also includes extensive documentation in references/safety_policies.md on how to restrict this capability using declarative policies (e.g., policy.confirm_run_command(), policy.deny_all()) and OS-level sandboxing (RunCommandConfig.enable_sandbox=True).
[INDIRECT_PROMPT_INJECTION]: The SDK enables agents to ingest untrusted data via built-in tools like search_web and read_url_content, and external MCP servers.
Ingestion points: Untrusted data enters the agent context through web scraping (read_url_content) and external services (McpStreamableHttpServer).
Boundary markers: The skill documentation shows the use of system_instructions to guide agent behavior, though specific delimiters for untrusted content are not explicitly showcased in the examples.
Capability inventory: The agent possesses powerful capabilities including shell command execution (run_command), file system modification (create_file, edit_file), and multi-agent delegation (start_subagent).
Sanitization: The documentation describes how read_url_content scrapes content into structured markdown, which provides some structural normalization of external data.

google-antigravity-sdk