The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a runtime code executor in reference/medusa-exec.md that allows the AI agent to generate and run TypeScript code. The executeCode function writes the code to a temporary file on the server's disk and subsequently executes it using the require() function. This creates a powerful and potentially risky capability where the server's behavior is dynamically determined by LLM output.
[COMMAND_EXECUTION]: The MedusaExec tool provides the agent with full access to the MedusaContainer, enabling it to perform any operation the server process is capable of, including direct database queries and mutations, triggering workflows, and interacting with other services.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a high-privilege attack surface (arbitrary code execution) that processes conversation history. If the agent reads untrusted data from the store (e.g., product reviews or descriptions) and includes it in the conversation context, an attacker could potentially influence the agent to generate and execute malicious code via MedusaExec.
Ingestion points: The conversation messages provided to the POST chat endpoint in reference/api-route.md.
Boundary markers: Not present. The skill does not specify the use of delimiters or 'ignore' instructions for external data interpolation.
Capability inventory: The executeCode function provides arbitrary TypeScript execution with access to the system's dependency injection container.
Sanitization: Not present. The skill relies on LLM compliance and a 30-second execution timeout rather than code sanitization or secure sandboxing.
[PRIVILEGE_ESCALATION]: The MedusaExec tool allows for actions that might bypass standard API constraints. The skill documentation emphasizes that all agent routes must be protected by AuthenticatedMedusaRequest to mitigate the risk of unauthenticated remote code execution.

creating-agents-in-medusa