The Agent Skills Directory

[DYNAMIC_EXECUTION]: The PersistentWorkflow class in references/advanced_patterns.md utilizes the pickle module for saving and loading state to a local file (workflow_state.pkl). Specifically, pickle.load() is used, which is susceptible to arbitrary code execution if the serialized data is tampered with by an attacker.
[REMOTE_CODE_EXECUTION]: In references/advanced_patterns.md, the MCP (Model Context Protocol) integration example demonstrates using npx to execute the @modelcontextprotocol/server-filesystem package directly. While this is an official package, the pattern involves fetching and running code from a remote registry at execution time.
[INDIRECT_PROMPT_INJECTION]: The skill describes building agents that ingest data from untrusted external sources using tools such as SerperDevTool for search and ScrapeWebsiteTool for web scraping in SKILL.md. This creates a vulnerability where malicious content on external sites could contain instructions that hijack the agent's logic.
Ingestion points: SerperDevTool, ScrapeWebsiteTool, WebsiteSearchTool, YoutubeSearchTool (SKILL.md).
Boundary markers: None implemented in the provided agent configuration examples to delimit external data from instructions.
Capability inventory: Agents have the ability to write files (output_file in Task), execute arbitrary tools, and make network requests via built-in tools.
Sanitization: No evidence of input sanitization or output validation is present in the documentation for handling tool results.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of several external Python packages including crewai and crewai-tools and suggests using npx for fetching Node.js-based MCP servers. These are well-known resources but represent a dependency on external code repositories.

crewai-developer