The Agent Skills Directory

Dynamic Code Execution (eval): The calculate tool example in skill.md utilizes the eval() function to process mathematical expressions. While the example includes a character whitelist (0123456789+-*/(). ), the use of eval() on data derived from user prompts is a security consideration. If the validation logic is bypassed or modified, it could potentially allow for arbitrary code execution within the agent's environment.
Indirect Prompt Injection Surface: The skill describes patterns for multi-agent delegation and tool output processing (e.g., custom_tool_node, supervisor). These workflows ingest data from external sources and subagents, creating a surface for indirect prompt injection. If tool outputs or subagent responses contain adversarial instructions, they could influence the supervisor or main agent's behavior.
Ingestion points: state["messages"] in agent and supervisor functions, and result from execute_tool in custom_tool_node.
Boundary markers: The skill demonstrates basic system prompts but lacks explicit delimiter usage or "ignore instructions" directives for handling untrusted tool outputs.
Capability inventory: The skill showcases capabilities for filesystem access (FilesystemBackend), network-based tools (search_tool), and subagent execution.
Sanitization: The calculate tool implements character whitelisting, but other tool execution patterns rely on simple string conversion of results.
Filesystem Access: The DeepAgents and FilesystemBackend examples demonstrate the ability to read and write to local directories (e.g., ./workspace). In an environment where the agent processes untrusted external data, this capability should be scoped to ensure the agent does not access sensitive system files.

langchain-agents