The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs users and agents to download setup scripts and the 'belt' CLI from the inference.sh domain and the vendor's official GitHub repository (github.com/inference-sh). These are standard resources required to interface with the code execution service.
[COMMAND_EXECUTION]: The skill utilizes the belt CLI tool via the Bash tool to communicate with the execution backend. The allowed-tools frontmatter restricts the agent's shell access specifically to the belt utility.
[DYNAMIC_EXECUTION]: The skill is designed to execute arbitrary Python scripts provided in the input. This execution occurs in a remote sandboxed environment that supports over 100 libraries, including pandas, playwright, and trimesh.
[INDIRECT_PROMPT_INJECTION]: The skill processes code provided through the code input field, creating a surface where untrusted data could be interpreted as instructions.
Ingestion points: The code field in the JSON input for the belt app run command located in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to prevent the agent from accidentally executing malicious payloads embedded in processed data.
Capability inventory: The execution environment supports network requests (via requests, httpx) and file creation within the outputs/ directory, though these are performed within a remote sandbox.
Sanitization: There is no indication of input sanitization or validation performed by the agent before the code is sent for execution.

python-executor