The Agent Skills Directory

[DYNAMIC_EXECUTION]: The CLI enables arbitrary code execution via the sandbox run and skill execute commands. sandbox run executes Python scripts provided by the user, while skill execute runs shell commands within a platform-managed sandbox environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes large volumes of external data, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through bkn search, context search-schema, and various resource query commands (SKILL.md, references/context.md, references/bkn.md).
Boundary markers: There is no mention of explicit boundary markers or instructions to ignore embedded content when processing retrieved network data.
Capability inventory: The skill has access to network operations (openbkn call), file management, and sandboxed code execution (sandbox run, skill execute).
Sanitization: The documentation does not describe any sanitization or filtering of external data before it is presented to the agent.
[CREDENTIALS_UNSAFE]: The tool manages sensitive credentials, including OAuth tokens and long-lived AppKeys, which are stored in the ~/.bkn/ local directory. Additionally, the sandbox run command features a --pass-token flag that injects the active session token into the BKN_TOKEN environment variable, exposing it to the code running within the sandbox.
[COMMAND_EXECUTION]: Through the skill execute command, the skill allows the execution of arbitrary shell entries on the remote BKN platform within a sandbox session.
[EXTERNAL_DOWNLOADS]: The skill install and skill download commands allow for the retrieval and installation of external skill packages from the platform's object storage.

openbkn