The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's documentation and reference files (SKILL.md, references/tools.md) explicitly recommend and demonstrate the use of the Python 'eval()' function within custom tool implementations, such as the 'CalculatorTool'.
Evidence in SKILL.md: 'result = eval(expression)'
Evidence in references/tools.md: 'result = eval(expression)'
This pattern allows for arbitrary code execution if a malicious payload is passed to the tool. Even the 'safe' version provided in the references, which checks for alphabetic characters, can be bypassed using Python's complex expression syntax and symbol-based payloads.
[INDIRECT_PROMPT_INJECTION]: The framework is designed to ingest and process data from a wide variety of untrusted external sources, making it vulnerable to indirect prompt injection attacks.
Ingestion points: Data enters the agent context through tools like 'ScrapeWebsiteTool', 'SerperDevTool', 'PDFSearchTool', 'GithubSearchTool', and 'DirectoryReadTool'.
Boundary markers: The provided examples do not demonstrate the use of delimiters or specific instructions to help the model distinguish between system instructions and untrusted data.
Capability inventory: Agents are equipped with high-impact capabilities including code execution (via 'CodeInterpreterTool' and 'eval'), file system modifications ('FileWriterTool'), and outbound network operations.
Sanitization: No sanitization, escaping, or validation logic for external content is included in the standard workflow examples.
[CREDENTIALS_UNSAFE]: Reference documentation for database and cloud platform integrations (references/tools.md) demonstrates passing sensitive credentials as plain-text string literals in code snippets.
Evidence: Configuration examples for 'MySQLSearchTool', 'PostgreSQLTool', and 'DatabricksQueryTool' show hardcoded host, user, password, and token fields.
While the troubleshooting guide mentions environment variables, the primary documentation encourages a practice that leads to accidental credential exposure in source code.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of multiple third-party libraries and promotes the integration of over 50 external API services.
Core dependencies include 'crewai' and 'crewai-tools'.
Integrations include services like Serper, Tavily, Firecrawl, Brave, EXA, Composio, and Zapier. While many are well-known, the broad connectivity requirements increase the potential for data exfiltration if the agent is compromised via injection.

crewai-multi-agent