The Agent Skills Directory

[DYNAMIC_EXECUTION]: The executeCode function in reference/medusa-exec.md implements a runtime execution environment. It uses fs.writeFileSync to write LLM-generated TypeScript to a temporary file in the current working directory and then uses require() to load and execute that file. This pattern constitutes dynamic code generation and loading from computed paths.
[COMMAND_EXECUTION]: The medusaExecTool allows the agent to generate and execute arbitrary TypeScript code with full access to the Medusa dependency injection container (MedusaContainer). This gives the agent unrestricted programmatic access to the host application's database and internal services, which is highly sensitive if the agent's logic is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill defines agents that query and process store data, creating a surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through query.graph() calls within the MedusaExec tool (reference/medusa-exec.md) and through the message history passed to the POST API route (reference/api-route.md).
Boundary markers: The system prompts outlined in reference/agent-setup.md do not utilize explicit delimiters or instructions to ignore potential commands embedded in store data (e.g., product descriptions or customer notes).
Capability inventory: The skill includes capabilities for filesystem writes (writeFileSync), dynamic module loading (require), and full database/service access via the Medusa container.
Sanitization: There is no evidence of sanitization, escaping, or schema validation for data retrieved from the store before it is presented to the model or processed within the execution environment.

creating-internal-agents