The Agent Skills Directory

[DYNAMIC_EXECUTION]: Documentation and reference files (specifically SKILL.md and references/tool-builder.md) provide code examples that demonstrate the use of eval() to process mathematical expressions from tool arguments. While intended for a calculator tool, eval() is a high-risk function that executes arbitrary strings as code.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill's documentation instructs users to install external skills via commands like npx skills add belt-sh/cli. These references point to third-party sources whose security cannot be verified within the context of this skill.
[INDIRECT_PROMPT_INJECTION]: The SDK establishes a large attack surface for indirect prompt injection through its data handling and agent capabilities.
Ingestion points: The skill ingests untrusted external data via agent.sendMessage content, client.run input objects, and multiple file upload mechanisms (local paths, buffers, blobs, and data URIs).
Boundary markers: The provided code patterns and documentation lack instructions or implementations for using boundary markers or system instructions to ignore potential commands embedded in processed data.
Capability inventory: Agents built using these patterns have access to high-impact tools, including codeExecution(true), webSearch(true), webhookTool for external network operations, and comprehensive file management capabilities.
Sanitization: Documentation examples do not demonstrate sanitization, validation, or escaping of external inputs before they are processed by the LLM or passed to executable tools.

javascript-sdk