The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The MCPAgent.create_tool method in SKILL.md implements a pattern where the agent uses an LLM to generate Python code for a new tool, writes that code to a file (server.py), and then executes it by connecting the new server. This allows for arbitrary code execution if the LLM's output is influenced by malicious instructions.
[DYNAMIC_EXECUTION]: The MCPAgent.create_tool logic is a form of dynamic code generation and runtime execution. It compiles and loads new functionality from generated strings without adequate validation or sandboxing of the resulting executable code.
[COMMAND_EXECUTION]: The SandboxedExecution.execute_sandboxed method in SKILL.md uses subprocess.run(command, shell=True). While it attempts to validate the base command against an allowlist, the use of shell=True on the full command string remains vulnerable to shell metacharacter injection (e.g., using ;, &&, or | to execute unauthorized commands alongside allowed ones).
[INDIRECT_PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection attacks:
Ingestion points: ContextManager.add_url in SKILL.md fetches arbitrary external content via requests.get().
Boundary markers: The format_for_prompt method uses simple Markdown headers (## URL: {url}) without robust delimiters or instructions to the LLM to ignore embedded commands.
Capability inventory: The skill includes tools for file writing (write_file), file editing (edit_file), shell command execution (run_command), and dynamic tool creation (create_tool).
Sanitization: There is no evidence of sanitization, filtering, or escaping for external content before it is interpolated into the agent's prompt context.

autonomous-agent-patterns