The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill introduces multiple mechanisms for runtime code generation and execution:
The CodeMode capability allows the agent to write Python scripts that are executed in the 'Monty' sandbox. While restricted to a stdlib allowlist, this allows for the execution of model-generated logic.
The CapabilityCreation capability (pydantic_ai_harness.capability_creation) explicitly allows an agent to 'author, validate, and load real capabilities at runtime'. Loading agent-authored code into the execution environment is a high-risk dynamic loading pattern.
The DynamicWorkflow capability orchestrates sub-agents using model-written Python scripts.
[COMMAND_EXECUTION]: The Shell capability (pydantic_ai_harness.shell) enables the execution of commands in a subprocess. Although it implements safety measures such as allowlists, a default denylist, and environment variable masking, it provides a direct interface for shell-based operations.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection due to its data ingestion capabilities combined with high-privilege tools:
Ingestion points: The agent ingests external data through the FileSystem (reading files), RepoContext (loading repository structure and documentation), and ToolOutputLimits.
Boundary markers: The instructions do not specify explicit boundary markers or 'ignore' instructions for the data ingested by these capabilities.
Capability inventory: The agent has access to Shell (command execution), CodeMode (Python execution), and FileSystem (file write/edit).
Sanitization: Shell uses allowlists; FileSystem uses traversal prevention; CodeMode uses the Monty sandbox. However, the combination of reading untrusted files and having the ability to execute code or shell commands remains a vulnerability surface.
[EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install pydantic-ai-harness and its extras (e.g., codemode) via the uv package manager. These are official packages from the vendor 'pydantic' and are considered safe functionality for this library.

pydantic-ai-harness