The Agent Skills Directory

[DYNAMIC_EXECUTION]: The MCPAgent.create_tool method in SKILL.md implements a pattern where the agent generates Python code via an LLM, writes that code directly to a file (server.py), and then immediately loads and executes it via connect_server. This represents a self-modifying code pattern that could be exploited to execute arbitrary logic.
[COMMAND_EXECUTION]: The SandboxedExecution.execute_sandboxed method in SKILL.md uses subprocess.run with shell=True. Although it includes a validation step for the base command, using shell=True increases the risk of shell injection if the validation logic is bypassed.
[DATA_EXFILTRATION]: The ContextManager.add_url method in SKILL.md uses the requests library to fetch content from arbitrary external URLs. This capability can be used to exfiltrate data or retrieve malicious payloads from remote servers.
[INDIRECT_PROMPT_INJECTION]: The skill describes architecture for agents that ingest untrusted data from various sources.
Ingestion points: ContextManager (SKILL.md) ingests data from local files, folders, and external URLs.
Boundary markers: The format_for_prompt method uses standard markdown headers but lacks explicit instructions to the LLM to ignore embedded commands within the content.
Capability inventory: The skill provides templates for shell command execution (SandboxedExecution), file modification (EditFileTool), and browser automation (BrowserTool).
Sanitization: No explicit sanitization or escaping of external content is present in the ContextManager or prompt formatting logic.

autonomous-agent-patterns