The Agent Skills Directory

[DYNAMIC_EXECUTION]: Documentation examples in references/tool-builder.md and references/agent-patterns.md demonstrate the use of eval() to process arguments received from tool calls (e.g., eval(call.args['expression'])). This promotes a pattern susceptible to Remote Code Execution (RCE) if an agent generates or processes a malicious expression.
[DATA_EXFILTRATION]: The SDK supports "Automatic File Upload" as described in SKILL.md and references/files.md. Any string in the input schema that matches a local file path is automatically read and uploaded to the vendor's cloud infrastructure. This creates a risk where an attacker could influence the agent to upload sensitive configuration or credential files (e.g., .ssh/id_rsa, .env) by providing them as input values.
[COMMAND_EXECUTION]: The skill's configuration (allowed-tools) permits broad shell execution via Bash(python *). Additionally, the SDK includes a built-in code_execution internal tool that allows agents to write and run arbitrary Python code to solve tasks, as documented in references/agent-patterns.md.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends installing external tools such as npx skills add belt-sh/cli, which downloads and executes code from a third-party registry.
[METADATA_POISONING]: The description field in SKILL.md contains a significant amount of keyword stuffing ("Triggers") intended to manipulate skill discovery and search indexing rather than providing a clear functional summary.
[INDIRECT_PROMPT_INJECTION]: The skill builds agents that ingest data from multiple untrusted sources.
Ingestion points: Data enters the context via agent.send_message inputs, external file content from agent.send_message(..., files=[...]), and results returned from webhook_tool or app_tool calls.
Boundary markers: The SDK provides a human-in-the-loop mechanism (require_approval()), but its use is optional and depends on developer implementation.
Capability inventory: The agents have access to arbitrary code execution (internal tools and broad Bash permissions), network operations (webhooks and SDK API), and local file system access (via automatic uploads).
Sanitization: The provided examples lack sanitization for tool arguments or input file paths, increasing the risk of the agent executing embedded instructions within data.

python-sdk