The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a mechanism for interacting with a local LLM that includes user-provided data in the prompt template. This creates an attack surface where untrusted data processed by the agent could contain malicious instructions meant to subvert the agent's logic.
Ingestion points: The question parameter in the ask() function provided in the Python client within SKILL.md.
Boundary markers: The prompt uses <|im_start|> and <|im_end|> delimiters to structure the conversation, but lacks specific defensive instructions to the model to ignore any embedded commands within the user-supplied input.
Capability inventory: The skill is capable of reading local configuration files (~/.config/mlx-dspark/api_key) and making local network requests to the inference server (http://127.0.0.1:8090).
Sanitization: There is no evidence of input validation, escaping, or filtering of the user text before it is placed in the prompt.
[DATA_EXFILTRATION]: The provided Python client performs a programmatic read of a sensitive local file containing an API key (~/.config/mlx-dspark/api_key). This credential is then used in the Authorization header for requests sent to a local endpoint (http://127.0.0.1:8090). While this is functional behavior for a local LLM client and targets a loopback address, it constitutes programmatic access to sensitive credential files on the host system.

local-llm