The Agent Skills Directory

[COMMAND_EXECUTION]: The references/tool-builder.md file provides code examples that use the unsafe Python eval() function to process input generated by the AI agent (e.g., result = eval(call.args['expression'])). If the agent is influenced by malicious instructions, this could lead to arbitrary command execution on the host system.
[REMOTE_CODE_EXECUTION]: The SDK features an internal tool for code_execution (seen in references/agent-patterns.md and references/tool-builder.md) that allows agents to write and run Python code. While intended for developer assistance, this capability allows for remote code execution if the agent's logic is subverted.
[DATA_EXFILTRATION]: The file handling system described in SKILL.md and references/files.md automatically uploads files if a string in the input matches a local file path. This creates a risk where an agent could be tricked into exfiltrating sensitive local configuration files (like .env, ~/.aws/credentials, or SSH keys) to the platform's cloud storage.
[DATA_EXFILTRATION]: The webhook_tool documented in references/tool-builder.md allows agents to send data to external URLs. This provides a direct channel for data exfiltration if the agent is directed to harvest and transmit sensitive information.
[EXTERNAL_DOWNLOADS]: The skill instructs users to install the inferencesh package from PyPI and allows agents to dynamically load content from remote URLs for context (e.g., https://example.com/skills/api-docs.md).
[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection due to its architecture:
Ingestion points: Untrusted data enters the agent context via web_search capabilities and responses from third-party app_tool integrations.
Boundary markers: Documentation examples do not demonstrate the use of delimiters or 'ignore' instructions for external content.
Capability inventory: The skill provides access to eval() calls, file-system writing (references/files.md), and arbitrary code execution (references/agent-patterns.md).
Sanitization: There is no evidence of input validation or sanitization before passing external data to the execution tools.

python-sdk