The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted natural language inputs to generate executable code.
Ingestion points: Untrusted data enters the agent context through the instruction and bullets[].content fields as defined in the Input Format section of SKILL.md.
Boundary markers: Absent. The skill does not define delimiters or provide instructions to the agent to ignore potentially malicious embedded instructions within the input data.
Capability inventory: The generated code can perform sensitive operations across multiple services, including reading and sending emails (apis.gmail), making payments (apis.venmo), and accessing personal contacts (apis.contacts) and calendars (apis.calendar).
Sanitization: Absent. There is no evidence of validation, escaping, or filtering of the input content before it is interpolated into the code generation process.
[CREDENTIALS_UNSAFE]: The skill instructions and code examples repeatedly use hardcoded credentials (e.g., username="user@example.com", password="password"). While these are presented as test credentials for the AppWorld environment, they demonstrate and encourage insecure credential management practices within the generated scripts.
[COMMAND_EXECUTION]: The skill's core purpose is the generation of Python scripts that are explicitly designed to be immediately executed by an external component (the AppWorld executor). This dynamic script generation and execution path creates a high-risk surface area where malicious input can be converted directly into functional code execution.

generate-appworld-code