The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file uses directive language to ensure the agent uses specific model versions (e.g., claude-opus-4-6) and prioritizes adaptive thinking modes. This overrides default agent reasoning. Additionally, the skill presents a surface for indirect prompt injection:
Ingestion points: The agent is prompted to use WebFetch and WebSearch tools to ingest untrusted data from the internet (referenced in SKILL.md).
Boundary markers: Instructions do not provide delimiters or security warnings to the agent regarding instructions that might be embedded in fetched content.
Capability inventory: The agent has access to highly sensitive tools including Bash, Edit, Write, and the ability to spawn subagents (Agent tool) (described in python/agent-sdk/README.md).
Sanitization: There are no requirements for the agent to sanitize or validate external content before processing it.
[COMMAND_EXECUTION]: The Agent SDK documentation (e.g., in python/agent-sdk/README.md) provides a Bash tool for executing shell commands. While it notes that dangerous operations prompt for confirmation by default, it also documents a bypassPermissions mode. This capability, when exposed to an agent processing untrusted data, increases the risk of unauthorized system modification.
[DATA_EXFILTRATION]: The skill documents tools for file system access (Read, Glob, Grep). When combined with network-capable tools or examples (like WebFetch or standard API requests), this creates a vector where sensitive local data could be read and then transmitted to external endpoints if the agent is manipulated.
[REMOTE_CODE_EXECUTION]: The skill documents the 'Code Execution' server-side tool and the use of MCP servers for browser automation and database access. While these are legitimate features, they involve executing code or interacting with remote services based on model decisions.
[EXTERNAL_DOWNLOADS]: The skill provides installation instructions for official Anthropic SDKs across multiple languages (Python, TypeScript, Go, Java, etc.) and references third-party tools like Playwright. These originate from well-known and trusted sources.

claude-api