The Agent Skills Directory

[DYNAMIC_EXECUTION]: The code example for a calculate tool uses the Python eval() function on a string argument (expression). This is a well-known vulnerability that can lead to arbitrary code execution if the input is not strictly sanitized, as the LLM or a user could pass malicious Python commands to the tool.
[COMMAND_EXECUTION]: The skill demonstrates the use of LocalCommandLineCodeExecutor, which allows an AI agent to execute shell commands on the local host. While this is a documented feature of the framework, it presents a significant security surface area if used without strict constraints.
[INDIRECT_PROMPT_INJECTION]: The skill implements an architecture where agents process and act upon data from tools (e.g., search_database) and other agents.
Ingestion points: Data enters the context via the search_database tool output and multi-agent message passing in RoundRobinGroupChat and SelectorGroupChat (SKILL.md).
Boundary markers: The examples do not show explicit boundary markers or 'ignore embedded instructions' warnings for tool outputs.
Capability inventory: The skill includes LocalCommandLineCodeExecutor (SKILL.md) for shell command execution and eval() for Python execution.
Sanitization: There is no evidence of sanitization or filtering for data processed from the search tool or between agents before it reaches the execution capabilities.

autogen-development