The Agent Skills Directory

[DYNAMIC_EXECUTION]: The 'Codemode' feature (referenced in references/codemode.md) allows the agent to generate and execute JavaScript code at runtime. While the system is designed to run within an isolated Worker sandbox with restricted network access, the capability to execute model-generated logic is highly powerful and requires strict isolation.
[DYNAMIC_EXECUTION]: The 'Browse the Web' functionality (referenced in references/browse-the-web.md) enables the model to perform browser automation by executing asynchronous JavaScript IIFEs within a browser session for scraping and interaction tasks.
[DYNAMIC_EXECUTION]: The 'Think' agent class (referenced in references/think.md) includes a built-in 'execute' tool. This provides a mechanism for the agent to run automated tasks or scripts, increasing the potential impact of a successful prompt injection attack.
[INDIRECT_PROMPT_INJECTION]: The skill documents multiple vectors for ingesting untrusted external data, creating a surface for indirect prompt injection where malicious instructions could influence agent behavior.
Ingestion points: Incoming mail handlers (onEmail in references/email.md), webhook request processing (onRequest in references/webhooks-push.md), and integrations with external Model Context Protocol (MCP) servers (references/mcp.md).
Boundary markers: The provided code examples do not explicitly demonstrate the use of boundary markers or instructions to ignore embedded commands in external data.
Capability inventory: The agent is equipped with high-impact capabilities including database access (SQLite), network communication (Fetch/MCP), and dynamic code generation (Codemode).
Sanitization: Although signature verification is showcased for webhooks, there is no evidence of content sanitization or filtering for data received from email or MCP sources before it is passed to the language model.

agents-sdk