The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources including Slack attachments and web content, creating a surface where malicious instructions embedded in documents could influence the agent's behavior during retrieval. \n
Ingestion points: File ingestion (rag_ingest), Slack attachments (rag_ingest_base64), and web URLs (rag_ingest_url) as documented in SKILL.md. \n
Boundary markers: The skill mandates the use of mandatory citation fields and confidence scoring (Self-RAG) to validate results, though it does not explicitly define prompt delimiters for raw content. \n
Capability inventory: The agent can access live network state via external MCP tools (pyATS, NetBox) and perform file writes via the rag_snapshot tool. \n
Sanitization: Documentation describes automated secret scrubbing to remove passwords, SNMP communities, and auth keys from snapshot data before vectorization. \n- [EXTERNAL_DOWNLOADS]: The skill provides tools for fetching data from external URLs, which could be used to ingest malicious content. \n
Evidence: The rag_ingest_url tool enables fetching web pages for corpus ingestion. \n
Mitigation: The skill implements a mandatory 'preview first' workflow and a human-in-the-loop confirmation requirement for all web crawling operations. \n- [COMMAND_EXECUTION]: The skill instructions include examples of shell command execution to interface with the local MCP server. \n
Evidence: Workflow documentation in SKILL.md shows the agent calling python3 $MCP_CALL to execute local scripts like rag_mcp_server.py.

rag