The Agent Skills Directory

[DYNAMIC_EXECUTION]: The MCPAgent class features a create_tool method that generates Python code via an LLM based on user descriptions, writes the output to a local file (server.py), and then dynamically connects to it as a new service. This pattern of generating and executing code at runtime is a high-risk behavior that can lead to arbitrary code execution if the LLM output is not strictly validated or sandboxed.
[COMMAND_EXECUTION]: The SandboxedExecution implementation uses subprocess.run with shell=True to execute shell commands. While it attempts to implement an allowlist and basic path validation, the use of shell=True is a security risk that can facilitate command injection and bypasses of intended restrictions.
[INDIRECT_PROMPT_INJECTION]: The ContextManager class includes an add_url method that fetches content from external URLs and injects it directly into the agent's prompt context.
Ingestion points: ContextManager.add_url in SKILL.md fetches content from arbitrary remote URLs.
Boundary markers: The format_for_prompt method lacks robust delimiters or instructions to ignore embedded commands within the fetched content.
Capability inventory: The skill includes tools for file writing (EditFileTool), command execution (SandboxedExecution), and dynamic tool creation (MCPAgent).
Sanitization: No security-focused sanitization is performed on the fetched content; only basic markdown conversion is applied.
[DATA_EXPOSURE]: The ReadFileTool and ContextManager classes allow the agent to read file contents from the local filesystem. The implementation of ReadFileTool lacks path validation (such as ensuring paths remain within a workspace directory), which could allow an agent to read sensitive files via path traversal attacks.

autonomous-agent-patterns