The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides code examples that define a "Calculator" tool using the Python eval() function. This implementation allows for the execution of arbitrary Python code if the agent is directed to process a malicious string through this tool. This pattern is found in SKILL.md and references/agents.md.
[DYNAMIC_EXECUTION]: The skill references the PythonREPLTool in references/integration.md. This tool explicitly grants the agent the capability to execute Python code within its environment.
[DYNAMIC_EXECUTION]: In references/integration.md, the code example for loading a FAISS index utilizes the allow_dangerous_deserialization=True parameter. This configuration enables the use of pickle for loading data, which can result in arbitrary code execution if the index file is retrieved from an untrusted or compromised source.
[COMMAND_EXECUTION]: The skill includes documentation for the ShellTool in references/integration.md, which provides the agent with the ability to execute arbitrary shell commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill implements various document loading capabilities that ingest untrusted external data into the agent's context, creating a vulnerability surface for indirect prompt injection attacks.
Ingestion points: The skill utilizes WebBaseLoader, GithubFileLoader, PyPDFLoader, and CSVLoader to pull content from external websites, repositories, and files as documented in SKILL.md and references/rag.md.
Boundary markers: The provided code snippets do not implement specific delimiters or safety instructions to prevent the model from following commands embedded within the ingested data.
Capability inventory: The skill environment includes tools for Python code execution (eval, PythonREPLTool), shell command execution (ShellTool), and network access (requests.get, WebBaseLoader).
Sanitization: No sanitization or filtering logic is present in the document processing examples to strip potentially malicious instructions from the retrieved content.

langchain