The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents a pipeline (rag_query in SKILL.md) that reads dynamic data (retrieved document chunks via hybrid_search and local_rerank) and injects them directly into the system prompt window of the LLM model instance (messages=[{"role": "system", "content": ... + context}]). This represents an entry point for untrusted inputs to influence the agent execution environment if any processed vector store documents contain malicious commands or overrides.
Ingestion points: Document payloads containing text chunks retrieved from a Qdrant cluster are processed via hybrid_search and local_rerank inside SKILL.md before being concatenated into the variable context.
Boundary markers: The prompt uses static string markers (\n\n---\n\n) to merge chunks and includes structural guidance ("Answer the question using only the provided context. If the answer isn't in the context, say so."), which minimizes accidental obedience but is vulnerable to specialized adversarial payloads.
Capability inventory: The pipeline uses the openai Python SDK to invoke a local or remote language model interface (meta-llama/Llama-3.1-8B-Instruct). No local shell execution or destructive operations are exposed within the application loop.
Sanitization: No specialized validation or content filtering (e.g., stripping instruction-like text patterns) is enforced on retrieved database items before interpolation into the final LLM chat completion payload.

rag-infrastructure