The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file agents/engineering/engineering-ai-data-remediation-engineer.md describes a pattern where the system uses the Python eval() function to execute code snippets generated by a large language model (LLM).
The apply_fix_to_cluster function evaluates strings produced by the model to perform data transformations.
Although the agent includes basic validation logic to filter keywords like 'import' and 'os', the use of eval() on AI-generated content is inherently risky as it can be bypassed via sophisticated prompt injection.
[REMOTE_CODE_EXECUTION]: The agents/specialized/accounts-payable-agent.md agent instructs the environment to install and run the agenticbtc-mcp package using npx.
npx downloads and executes code directly from the npm registry at runtime.
This dependency originates from a third-party source (agenticbtc.io) that is not identified as a well-known or trusted service provider.
[COMMAND_EXECUTION]: Several agents, particularly agents/specialized/agents-orchestrator.md, are designed to execute various shell commands (e.g., ls, cat, grep, kubectl, npm test) to manage local files and deployment infrastructure.
These capabilities provide a significant attack surface for command injection if input data processed by the orchestrator is not strictly sanitized.
[DATA_EXFILTRATION]: The accounts-payable-agent.md provides tools to initiate external financial transactions (autonomous Bitcoin and USDC payments) via the AgenticBTC API.
This represents a high-impact capability that could lead to unauthorized fund transfers if the agent's instructions or the data it processes are manipulated.
[REMOTE_CODE_EXECUTION]: A recurring indirect prompt injection surface exists across multiple agents that ingest external data (e.g., project specifications in project-specs/, vendor data in accounts-payable-agent.md, and web content via WebFetch).
These ingestion points lack explicit boundary markers or sanitization to prevent the agent from obeying instructions embedded within the data.
When combined with the high-privilege capabilities (shell commands and financial operations) documented above, this creates a vulnerability where external data could trigger malicious actions.

agent-orchestra