The Agent Skills Directory

[DATA_EXFILTRATION]: The upload_file method in example.py reads data from local file paths and sends it to a remote API. This intended functionality allows for knowledge base management but lacks path restrictions, creating a surface for potential data exfiltration of sensitive local files if the agent's instructions are compromised.
[EXTERNAL_DOWNLOADS]: The documentation references a reference implementation of the RAG service hosted on the vendor's GitCode repository.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and retrieves untrusted data from local files.
Ingestion points: The upload_file method in example.py reads local file content that is later indexed and retrieved during queries.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt or code.
Capability inventory: The skill possesses file system read access and network communication capabilities via the requests library.
Sanitization: The implementation does not include sanitization of file content or validation of file paths.

RAGSkill