The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides complex multi-step shell and Python scripts in py/agent-deployment.md for environment preparation and dependency verification. The instructions explicitly direct the agent to execute these scripts verbatim as part of a 'blocking pipeline'.
Evidence: py/agent-deployment.md contains scripts for Step 2 (Atomic env/ rebuild) and Step 3 (Verification) which utilize pip install and python3.10 -c with large strings of code that parse the project's source using the ast module and inspect imports via importlib.
[REMOTE_CODE_EXECUTION]: The deployment verification logic involves the agent executing dynamically generated Python code provided within the markdown instructions to verify the integrity of the target environment.
Evidence: The scripts in py/agent-deployment.md (Step 3a and 3b) use python3.10 -c "..." to perform system-level checks on file paths and module availability.
[PROMPT_INJECTION]: The skill defines a protocol (AG-UI) for processing untrusted data from end-users, creating a surface for indirect prompt injection attacks where malicious instructions can be embedded in messages or state objects.
Ingestion points: Data enters the system via the messages, state, and context fields of the RunAgentInput model defined in py/server-quickstart.md and py/authentication.md.
Boundary markers: The provided documentation does not explicitly enforce or demonstrate the use of boundary markers or delimiters for untrusted user content.
Capability inventory: Agents built with this SDK have extensive capabilities including network access (LLM and Coze APIs), file system access (via built-in tools), and the ability to execute code in the hosting environment.
Sanitization: The SDK reference does not currently detail specific sanitization or filtering strategies for the incoming AG-UI message stream.
[EXTERNAL_DOWNLOADS]: The deployment process requires fetching numerous dependencies from well-known official registries.
Evidence: The skill references several cloudbase-agent-* packages and standard AI frameworks (LangGraph, LangChain, OpenAI) to be installed via pip and npm as seen in py/skill.md and ts/skill.md.

cloudbase-agent