The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation and provided framework code both implement a calculator tool using the Python eval() function. In SKILL.md, the calculate function directly passes expressions to eval() without sanitization. In scripts/simple_agent.py, the CalculatorTool uses eval() with restricted built-ins, which remains vulnerable to sandbox escape techniques that allow for arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: The framework established in scripts/simple_agent.py presents a significant attack surface for indirect prompt injection. Ingestion points: The agent processes untrusted data from the SearchTool and direct user input. Capability inventory: The agent has access to high-risk capabilities including code execution via eval() and network operations via the requests library. Boundary markers: The ReAct prompt implementation lacks robust delimiters or specific instructions to ignore malicious commands embedded in tool outputs. Sanitization: No input validation or escaping is performed before external content is incorporated into the agent's reasoning process.
[DYNAMIC_EXECUTION]: The CalculatorTool class in scripts/simple_agent.py performs dynamic execution of strings as Python code at runtime. This behavior enables the execution of arbitrary logic if an attacker can control the input string, which is a likely scenario given the identified prompt injection vulnerabilities in the agent's interaction loop.

agent-frameworks