The Agent Skills Directory

[COMMAND_EXECUTION]: The framework enables the execution of external tools and services via the Model Context Protocol (MCP). These executions are managed through developer-defined .mcp.json files, which specify the commands and arguments (e.g., npx -y perplexity-mcp) to be run in a child process.
[INDIRECT_PROMPT_INJECTION]: The skill implements a Retrieval-Augmented Generation (RAG) pattern where agents can read and search local markdown files in a knowledge/ directory. This creates a surface for indirect prompt injection if the ingested files contain adversarial instructions designed to bypass the agent's system prompt.
[SAFE]: The skill demonstrates high security maturity through several defensive implementations:
- Path Validation: The inside function uses realpathSync and relative path comparison to ensure that file access is strictly confined to the designated knowledge/ or skill directories, explicitly preventing access to sensitive files like .env or SSH keys.
- Error Masking: The guarded tool wrapper intercepts unplanned exceptions during tool execution. This prevents internal system details, database connection strings, or accidental credentials from being leaked into the model's context by returning a generic TOOL_FAILED message instead.
- Resource Ceilings: The askAgent loop enforces configurable limits on both the number of model turns (maxTurns) and the financial cost per run (maxBudgetUsd) to mitigate the risk of runaway loops or unexpected API costs.
- CSRF Protection: The API route implementation includes an origin check to verify that requests originate from the same host, protecting the agent from cross-site request forgery attacks.

embedded-agents-messages-api