The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes an exec tool designed to execute arbitrary Python code directly within the agent's process. While intended for diagnostics and utility, this allows the agent (and potentially an attacker via prompt injection) to perform any action the Python environment allows.
[DYNAMIC_EXECUTION]: The create_tool functionality enables the agent to generate new Python scripts, save them to the workspace/custom_tools/ directory, and hot-load them into the running process. This self-evolution feature bypasses static code review and allows for runtime expansion of the agent's capabilities.
[REMOTE_CODE_EXECUTION]: The system is configured to use the Model Context Protocol (MCP) and explicitly suggests using npx to download and run remote packages (e.g., @modelcontextprotocol/server-filesystem) at runtime. This introduces a dependency on external registries and risks executing unverified remote code.
[PRIVILEGE_ESCALATION]: The system includes a router.py component for multi-tenant routing that interacts with Docker to provision and manage containers. Managing Docker containers typically requires elevated system privileges, posing a risk of container escape or host system compromise if the routing logic is exploited.
[INDIRECT_PROMPT_INJECTION]: The agent processes untrusted external data from messaging platforms like WeChat Work and stores user-provided context in USER.md. Because the agent has high-impact capabilities like arbitrary code execution and infrastructure management, it is highly vulnerable to indirect prompt injection where malicious data triggers dangerous tool use.
[COMMAND_EXECUTION]: The system's architecture relies on shell command execution for its core features, including package installation via pip, container management via docker, and plugin execution via npx.

724-office-ai-agent