The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its data ingestion and processing architecture. Untrusted data from various sources (local files, S3, URLs) can be ingested into the knowledge graph, which is then processed by LLMs during extraction and retrieval phases.
Ingestion points: The add() function in SKILL.md and references/core-api.md accepts raw text, absolute file paths, file URLs, and S3 paths.
Boundary markers: No evidence of boundary markers or instructions to ignore embedded commands (e.g., in the custom_prompt parameter of cognify()) was found in the documentation.
Capability inventory: The skill possesses file system access, network connectivity for LLM providers, and database management capabilities (run_migrations).
Sanitization: There is no documented sanitization or validation logic to filter out instructional content from ingested files before they are processed by LLMs.
[COMMAND_EXECUTION]: The skill performs several operations that interact with the local environment and file system.
The add() function can read arbitrary local files if provided with absolute paths.
The visualize_graph() function writes HTML files to user-specified local paths.
The CLI provides commands to launch a local UI server (cognee --ui) and run database migrations (run_migrations).
[EXTERNAL_DOWNLOADS]: The skill enables fetching data from remote and external storage sources.
The add() function supports the s3:// protocol for Amazon S3 buckets and file:/// for network or local file URLs, representing an external data entry point.

cognee