The Agent Skills Directory

[COMMAND_EXECUTION]: The tutorial implements a bash_tool in agent_code/tools/bash_tool.py that uses subprocess.run(command, shell=True) to execute arbitrary shell commands. This capability allows the agent to interact with the underlying system based on model-generated input.\n- [EXTERNAL_DOWNLOADS]: The installation instructions direct users to clone a repository from an untrusted source (https://github.com/bozhouDev/14days-build-claude-code-cli.git) and install its dependencies.\n- [REMOTE_CODE_EXECUTION]: By instructing users to clone and execute code from an external repository using git clone and uv run, the skill establishes a workflow for running potentially unverified code on the host machine.\n- [DYNAMIC_EXECUTION]: The agent loop dynamically processes tool_use blocks from the LLM response and executes the corresponding functions, which includes performing file operations and running shell commands.\n- [PRIVILEGE_ESCALATION]: The bash_tool recognizes dangerous commands like sudo and implements a manual permission check, acknowledging the risk of privilege escalation within the shell environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection as it ingests data from local files and uses that information to drive agent actions.\n
Ingestion points: File content is read via read_file_tool in agent_code/tools/file_tools.py and provided to the agent model.\n
Boundary markers: The provided implementation does not include boundary markers or specific instructions to help the model ignore potentially malicious commands embedded within the files it reads.\n
Capability inventory: The agent has capabilities to modify the file system (write_file_tool) and execute bash commands (bash_tool).\n
Sanitization: Security is primarily managed through a manual confirmation prompt and a static list of dangerous command patterns, which may be insufficient to block sophisticated injection attempts.

14days-build-claude-code-cli