The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation describes the integration of ShellTools, which provides the agent with a persistent bash session. This allows the agent to execute arbitrary shell commands, manage environment variables, and perform file system operations such as read, write_file, and replace across multiple interactions.
[REMOTE_CODE_EXECUTION]: The TextSkill class enables the execution of scripts bundled with the skill through the run_script method. Additionally, the Model Context Protocol (MCP) integration allows the agent to connect to remote servers and invoke tools dynamically, which constitutes remote code execution if the server or its responses are untrusted.
[DATA_EXFILTRATION]: The skill facilitates data exfiltration by providing both broad file system access (via ShellTools) and network communication capabilities (via MCP and multimodal URL fetching). This combination allows an agent to read sensitive local files and transmit their contents to external endpoints.
[EXTERNAL_DOWNLOADS]: The skill supports fetching external content through MCPManager (connecting to remote MCP servers) and multimodal classes like Image.from_url, which download data from user-provided or external URLs.
[INDIRECT_PROMPT_INJECTION]: The skill defines several surfaces for indirect prompt injection where malicious instructions could be embedded in data processed by the agent.
Ingestion points: Untrusted data can enter the agent context through shell.read, TextSkill.read_file, Image.from_url, and the outputs of tools hosted on remote MCP servers.
Boundary markers: There are no documented boundary markers or instructions to ignore embedded commands when processing these external data sources.
Capability inventory: The agent has extensive capabilities including shell command execution (shell.run), file system writes (shell.write_file), and execution of local scripts (run_script).
Sanitization: The skill does not implement or describe any sanitization, validation, or escaping logic for data ingested from files or network sources before it is used to influence agent behavior.

nooa-tools-and-skills