The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The executeCode function located in reference/medusa-exec.md uses fs.writeFileSync to write AI-generated content to a temporary .ts file on disk and then immediately executes it using the require() function. This enables the agent to execute arbitrary logic with the full privileges and context of the server process.
[COMMAND_EXECUTION]: The MedusaExec tool, as described in SKILL.md and reference/medusa-exec.md, is designed to give the AI agent the capability to perform any data operation or system task by generating and running scripts. This effectively bypasses standard API constraints and security boundaries by allowing the agent to define its own execution logic at runtime.
[DATA_EXFILTRATION]: Because the MedusaExec tool provides full access to the MedusaContainer and the underlying Node.js runtime, an agent could be instructed (maliciously or otherwise) to read sensitive environment variables, database secrets, or customer data and transmit them to external endpoints using standard networking modules.
[INDIRECT_PROMPT_INJECTION]: The skill architecture creates a significant surface for indirect prompt injection by processing untrusted data with high-privilege tools.
Ingestion points: Untrusted user input enters through the POST route in src/api/admin/agent/<agent-type>/route.ts and is stored in the AgentMessage model via reference/api-route.md.
Boundary markers: The implementation lacks delimiters or explicit instructions for the model to ignore potential injection attempts within the conversation history.
Capability inventory: The skill includes powerful capabilities such as arbitrary code execution via MedusaExec and full database access through the MedusaContainer.
Sanitization: There is no validation or sanitization of the AI-generated TypeScript code before it is passed to the executor in reference/medusa-exec.md.

creating-internal-agents