The Agent Skills Directory

[COMMAND_EXECUTION]: Found in the infrastructure reference file skills/hosted-agents/references/infrastructure-patterns.md. The Python code example for sandbox management uses os.system with f-string interpolation for user_identity["name"] and user_identity["email"]. This pattern is susceptible to command injection if user-provided identity information is not strictly validated before being used in shell commands.
[REMOTE_CODE_EXECUTION]: Detected in the tool implementation within examples/interleaved-thinking/examples/03_full_optimization.py. The calculator tool utilizes the Python eval() function to process a mathematical expression parameter. Although the implementation attempts to restrict execution by removing builtins and using a whitelist of allowed functions, the use of eval() on input derived from an agent's reasoning chain (which can be influenced by user prompts) poses a significant code injection risk in complex agentic loops.

context-engineering-collection