The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides multiple implementation examples (in 'SKILL.md' and 'references/examples.md') of a ReAct agent using a calculator tool defined as "calculator": lambda expr: eval(expr). The use of eval() on unsanitized strings generated by an LLM allows for the execution of arbitrary Python code within the host environment.- [COMMAND_EXECUTION]: Because the eval() sink is connected to model-controlled output (action_input), the skill demonstrates a pattern that facilitates command execution. An attacker could use prompt injection to force the model to output Python commands that access the file system, network, or environment variables, which would then be executed by the calculator tool.- [INDIRECT_PROMPT_INJECTION]: The agent architecture described creates a vulnerable surface where untrusted input can reach a high-privilege execution sink.
Ingestion points: The react_agent function in both 'SKILL.md' and 'references/examples.md' ingests a user-provided question string which is then used to generate thoughts and actions.
Boundary markers: The examples lack explicit delimiters or instructions to the model to ignore potentially malicious instructions embedded in the data it processes.
Capability inventory: The skill implementation includes a direct path from model output to the eval() function, granting the model the capability to execute code.
Sanitization: There is no evidence of input validation, regex filtering, or sanitization of the action_input before it is passed to the eval() function in the provided examples.

guidance