The Agent Skills Directory

[DATA_EXFILTRATION]: The references/minimal-agent.py file lacks path sanitization in its read_file and write_file tool implementations. It directly joins the workspace directory with user-provided paths (e.g., WORKDIR / args["path"]), which allows for path traversal attacks. An agent using this template could be manipulated into reading or writing sensitive files outside the intended project directory.
[COMMAND_EXECUTION]: Multiple templates provided in scripts/init_agent.py, references/minimal-agent.py, and references/tool-templates.py implement a 'bash' tool using subprocess.run with shell=True. This grants the agent the ability to execute arbitrary shell commands on the host system. While some templates include a blocklist for dangerous commands (like sudo or rm -rf /), the 'minimal-agent' template does not, increasing the risk of misuse.
[DYNAMIC_EXECUTION]: The scripts/init_agent.py script is designed to generate and write new executable Python scripts to the filesystem based on hardcoded templates. This behavior is inherent to the skill's purpose as an agent builder but constitutes dynamic code generation.
[INDIRECT_PROMPT_INJECTION]: The agent loop patterns implemented in the templates ingest external data (tool outputs, file contents) directly into the model's message history without sanitization. This creates a surface for indirect prompt injection, where malicious instructions hidden in a file being read could override the agent's behavior.

agent-builder