The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation examples in SKILL.md, references/agent-patterns.md, and references/tool-builder.md demonstrate implementing tools using eval(call.args.expression). This practice is highly unsafe as it allows for the execution of arbitrary JavaScript code if the tool arguments are manipulated by an adversary via prompt injection.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @inferencesh/sdk Node.js package and the belt-sh/cli tool. While these are legitimate platform resources, they represent external code dependencies that the agent is instructed to fetch and execute.
[PROMPT_INJECTION]: The skill architecture is vulnerable to indirect prompt injection (Category 8) because it processes untrusted data from multiple sources without demonstrated sanitization.
Ingestion points: Untrusted data enters the agent context through agent.sendMessage (interpolating user inputs), file uploads via client.uploadFile, and external data fetched via webhookTool results.
Boundary markers: The provided code examples do not include delimiters or instructions for the agent to ignore embedded commands in external data.
Capability inventory: The skill documentation includes examples using Bash tools, network requests via fetch, file system writes with writeFileSync, and dynamic execution via eval.
Sanitization: No validation, escaping, or filtering of external content is present in the primary examples, although the skill mentions human-in-the-loop approval as an optional safety pattern.

javascript-sdk