The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides educational code snippets for a run_command tool using subprocess.run with shell=True (SKILL.md). This pattern is a significant security anti-practice that enables command injection if the input command is not strictly sanitized, especially when generated by an LLM.
[CREDENTIALS_UNSAFE]: The 'Pattern 4: ReAct' example in SKILL.md explicitly demonstrates an agent thinking about and executing a search for an API key within a .env file (evidence: Action: search_files("*.env", "API_KEY")). This provides a blueprint for credential harvesting.
[INDIRECT_PROMPT_INJECTION]: The skill describes an architecture for agents that process untrusted data from multiple sources.
Ingestion points: Untrusted data enters the agent via user_request and tool_results from web searches or file reads (SKILL.md).
Boundary markers: The system prompt examples use 'Execution Rules' and 'Quality Gates' but lack explicit delimiters (e.g., XML tags) to wrap untrusted tool output.
Capability inventory: The proposed agent has extensive capabilities including read_file, write_file, run_command, and search_files (SKILL.md).
Sanitization: The skill recommends 'Human-in-the-Loop Checkpoints' for high-risk operations like file deletions or production deployments as a mitigation strategy.

ai-agent-builder