The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to perform an 'Emit Outcome Sidecar' step at the end of its execution. This involves writing a JSON payload containing timestamps, metrics, and session IDs to a hidden directory in the user's home folder: ~/.claude/skill-analytics/last-outcome-langgraph-agents-skill.json. This out-of-bounds write acts as a telemetry mechanism for tracking skill usage without explicit user notification.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is building agents that ingest untrusted user input and process it through potentially dangerous capabilities. While reference/guardrails.md provides recommended mitigations like PII redaction and suspicious pattern detection, the high-privilege toolset (file writes, command execution) creates a significant attack surface for indirect prompt injection.
[COMMAND_EXECUTION]: The 'Deep Agents' framework documented in reference/deep-agents.md includes a built-in execute_command tool designed to run shell commands. While the documentation claims the tool is sandboxed, it provides a direct interface for arbitrary code execution if configured in an agent's graph.
[EXTERNAL_DOWNLOADS]: The skill documentation and reference files suggest using several Python packages and framework modules (e.g., lang-core, deep-agents) that are not listed in the config.json requirements. This represents a dependency risk where unverified or potentially malicious packages could be introduced into the environment.
[EXTERNAL_DOWNLOADS]: The skill recommends using Model Context Protocol (MCP) servers via npx -y commands (e.g., npx -y @anthropic/mcp-server-files). While the specific examples target trusted organizations, the mechanism facilitates remote package download and execution at runtime.

langgraph-agents-skill