The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection during the knowledge graph indexing phase.
Ingestion points: In scripts/index_corpus.py, the read_document and index_document functions ingest untrusted document content from a user-specified directory.
Boundary markers: The prompt templates extract_entities_prompt and extract_relationships_prompt in scripts/index_corpus.py use a simple "Text:" label to separate instructions from the document chunks. There are no robust delimiters or explicit warnings to the model to ignore instructions embedded within the processed text.
Capability inventory: The skill can read local files, write a JSON knowledge graph to the file system (via scripts/graph_ops.py), and perform network requests to Anthropic's API for processing content.
Sanitization: While scripts/index_corpus.py uses parse_json_response to ensure LLM outputs are valid JSON, it lacks mechanisms to validate or sanitize the semantic meaning of extracted entities and relationships, which could allow a malicious document to inject false or misleading data into the graph.

recursive-knowledge