The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources, creating a surface for indirect prompt injection attacks where malicious instructions could be embedded in retrieved documentation.
Ingestion points: Processes data from Notion, Zendesk, GitHub repositories, and local filesystem directories (Markdown/PDF files) as defined in SKILL.md and templates/brain/KNOWLEDGE_MAP_TEMPLATE.md.
Boundary markers: The skill's security section explicitly instructs the agent to wrap retrieved context in strict delimiters to prevent it from escaping and altering system instructions.
Capability inventory: Includes file system searching (grep), database queries (SQLite), and package installation/execution capabilities.
Sanitization: Recommends implementing PII and credential scrubbing middleware before data is chunked or sent to external embedding APIs.
[COMMAND_EXECUTION]: The skill uses shell-based commands for emergency knowledge retrieval.
Evidence: The instruction grep -r "keywords" agents/memory/semantic/ in SKILL.md suggests interpolating user-provided keywords into a shell command, which could lead to command injection if the keywords are not properly sanitized. The skill acknowledges this risk by recommending strict compartmentalization (chroot/jail) for these operations.
[EXTERNAL_DOWNLOADS]: The skill instructions include installing standard libraries and starting external tools.
Evidence: Recommends installing llama-index and qdrant-client via pip, and starting Flowise via npx. These are well-known tools in the AI development ecosystem.

knowledge-connect