The Agent Skills Directory

[COMMAND_EXECUTION]: The eval() function is used within Python functions that serve as tools for a dspy.ReAct agent in references/agent-patterns.md and references/program-patterns.md. While presented as examples for a calculator tool, using eval() on raw string input is a high-risk pattern that can lead to arbitrary code execution if the input is not strictly validated or if the agent is manipulated via indirect prompt injection to execute malicious code.\n- [DYNAMIC_EXECUTION]: The script scripts/check-setup.py uses __import__(pkg) to dynamically check for the presence of the dspy package. While used here for a benign environment check, dynamic imports can be a vector for loading unintended modules if the package names were derived from untrusted sources.\n- [INDIRECT_PROMPT_INJECTION]: The skill builds programs (RAG, ReAct agents) that ingest external data (search results, context) and process them through LLMs. The lack of explicit boundary markers or instructions to ignore embedded commands in the provided templates (e.g., templates/rag-program.py, templates/multi-step.py) creates a surface for indirect prompt injection attacks where malicious data could influence the agent's behavior.

dspy