The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation includes code examples that demonstrate the use of eval() to process arguments from tool calls (e.g., in a calculator tool example in references/tool-builder.md). Executing strings as code from potentially untrusted AI model outputs poses a significant security risk if not strictly sanitized.
[COMMAND_EXECUTION]: The skill facilitates the enabling of internal tools like codeExecution(true), which allows agents to run arbitrary code to solve problems, as shown in references/agent-patterns.md.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It builds agents that ingest untrusted data from user messages and local files (e.g., agent.sendMessage and files attachments). The examples provided do not demonstrate the use of boundary markers or specific sanitization techniques to prevent malicious instructions embedded in that data from influencing agent behavior.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @inferencesh/sdk package via standard package managers (npm, yarn, pnpm) and suggests adding the belt-sh/cli skill. These are associated with the vendor's own infrastructure and ecosystem.

javascript-sdk