The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates untrusted user content directly into the scoring prompt provided to the LLM.
Ingestion points: The content variable in the score_with_ollama and build_scoring_prompt functions (Step 3) serves as the primary entry point for untrusted data from the corpus being analyzed.
Boundary markers: The prompt uses simple escaped double quotes (Content: \"{content}\") to delimit the untrusted content. This is a weak boundary that can be easily bypassed by adversarial content (e.g., content containing " followed by a new instruction).
Capability inventory: The skill code performs HTTP requests to a local service (Ollama at localhost:11434) and writes checkpoint files to the local file system using the pathlib and json modules. If an injection successfully manipulated the model to produce specific output, it could influence the content of these local checkpoints.
Sanitization: There is no evidence of content sanitization, filtering, or the use of more robust framing techniques (like XML tags or distinct delimiters) to isolate the untrusted content from the system instructions.

llm-relevance-scoring