The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides templates for RAG pipelines that ingest untrusted data from external web search tools (Tavily, Exa) directly into LLM prompts without sanitization.
Ingestion points: Untrusted data enters the context via variables such as $SEARCH, $SEARCH_RESULT, $CONTENT, $EVIDENCE, $OVERVIEW, and $STATISTICS in SKILL.md.
Boundary markers: The templates use text headers (e.g., 'Search Results:', 'Source 1 (Tavily):') but lack explicit instructions or delimiters to prevent the LLM from following instructions embedded within the retrieved search results.
Capability inventory: The skill is configured with Bash(belt *) capabilities, allowing the execution of shell commands.
Sanitization: No escaping or filtering is applied to the retrieved content before it is interpolated into the prompts.
[DYNAMIC_EXECUTION]: The provided bash examples use direct shell variable interpolation of untrusted search data into command arguments, which could lead to command injection.
Evidence: Examples in SKILL.md such as belt app run ... --input "{ \"prompt\": \"... $SEARCH ...\" }" perform string interpolation.
Risk: If the search results contain shell metacharacters (e.g., backticks, semicolons, or quotes), they could be interpreted by the shell when executing the belt command.
[EXTERNAL_DOWNLOADS]: The skill references external resources for installation and encourages adding other skills from a specific platform repository.
Evidence: Links to installation guidelines on GitHub (https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md) and instructions to add skills via npx skills add inference-sh/skills@....

ai-rag-pipeline