The Agent Skills Directory

[DYNAMIC_EXECUTION]: Documentation in references/tool-builder.md includes a code example that uses the eval() function to process a 'calculation' expression directly from the AI agent (call.args.expression). This is a high-risk security anti-pattern that permits arbitrary code execution if the agent is manipulated into generating malicious payloads.\n- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for handling tool calls where agent-generated output is used without sanitization. In references/tool-builder.md, this is combined with the eval() function, creating a direct path for indirect prompt injection (e.g., from untrusted search results or files) to result in system-level code execution.

javascript-sdk