The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill enables the execution of LLM-generated TypeScript code via the execute_typescript tool. While isolation drivers are used to sandbox the environment, the ability to run arbitrary code is a high-risk capability.
[DYNAMIC_EXECUTION]: The skill facilitates runtime code generation, including TypeScript type stubs for tool bindings and dynamic discovery of lazy-loaded tools via the discover_tools server tool.
[PERSISTENCE_MECHANISMS]: Through the register_skill functionality and createFileSkillStorage, the agent can save code snippets to a local directory (e.g., ./.skills). These scripts are persisted across sessions and automatically loaded, providing a potential vector for maintaining malicious logic.
[CREDENTIALS_UNSAFE]: The documentation warns against passing API keys or secrets into the sandbox environment, as generated code could access and exfiltrate them. It highlights that secrets should be managed in the host process using environment variables.
[COMMAND_EXECUTION]: The use of the isolated-vm driver involves native C++ modules. The documentation notes that platform compatibility issues can cause unrecoverable errors like segfaults, emphasizing the complexity of native code execution within the sandboxing layer.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input (LLM-generated code) influenced by conversation messages. With tools for file writing and network requests, this creates a surface where injected instructions could lead to persistent compromise or data exfiltration.

tanstack-ai-code-mode