The Agent Skills Directory

[COMMAND_EXECUTION]: The calculate function defined in SKILL.md uses the Python eval() function to process the expression argument. This is a dangerous pattern that permits the execution of arbitrary Python code (e.g., system commands or file access) if the input is not strictly controlled and sanitized.
[REMOTE_CODE_EXECUTION]: Because the calculate tool is intended for use by an AI agent that handles potentially untrusted user input, the use of eval() provides a mechanism for Remote Code Execution (RCE) via prompt injection.
[EXTERNAL_DOWNLOADS]: The skill documentation provides instructions to install the google-adk library across various package managers including pip, npm, and go. These resources originate from a well-known service (Google) and are considered safe.
[INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection as it ingests untrusted data that flows into a tool with arbitrary code execution capabilities.
Ingestion points: User messages are ingested via the Runner and new_message content in SKILL.md.
Boundary markers: None. The agent instructions and prompt templates in SKILL.md (e.g., {user_name}) lack delimiters or instructions to treat injected variables as non-executable data.
Capability inventory: The skill provides a calculation tool in SKILL.md that leverages eval() for code execution.
Sanitization: There is no input validation or sanitization implemented for the expression string before it is passed to the Python interpreter.

adk