The Agent Skills Directory

[COMMAND_EXECUTION]: The provided Python example for a calculation tool utilizes the eval() function to process input strings.
Evidence: result = eval(expression) in the calculate function within SKILL.md.
Analysis: This creates a dynamic execution vulnerability where any valid Python code passed as the expression will be executed by the interpreter, allowing for host-level compromise if triggered by an agent.- [COMMAND_EXECUTION]: The instructions demonstrate how to enable agents to execute commands directly on the host system using LocalCommandLineCodeExecutor.
Evidence: code_executor = LocalCommandLineCodeExecutor(work_dir=\"./workspace\", timeout=60) in SKILL.md.
Analysis: Granting an LLM-based agent direct shell access to the host environment is a known risk. Although the skill also mentions Docker as a safer alternative, the inclusion of the local executor pattern without strict guardrails is a security concern.- [PROMPT_INJECTION]: The skill architecture facilitates processing external tasks through various agents without defining boundary markers or input sanitization.
Ingestion points: team.run(task=...) calls in SKILL.md.
Boundary markers: None present in the provided templates to separate task instructions from embedded data.
Capability inventory: Includes shell execution (LocalCommandLineCodeExecutor) and Python evaluation (eval).
Sanitization: No input validation or escaping logic is shown for tool arguments or task descriptions.
Analysis: This setup is vulnerable to indirect prompt injection, where a malicious task or processed data could manipulate the agent's logic or trigger its dangerous tool capabilities.

autogen-development