The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes responses from an external Flowise API. If the remote Flowise instance is compromised or contains malicious instructions in its knowledge base, this content could influence the agent's logic.
Ingestion points: API responses in scripts/prediction.py and scripts/messages.py are returned directly to the agent.
Boundary markers: There are no explicit delimiters or instructions to treat the API output as untrusted content.
Capability inventory: The agent, via this skill, has access to network operations and local file reading.
Sanitization: No sanitization is performed on the data retrieved from the remote API.
[DATA_EXFILTRATION]: The scripts/prediction.py script enables the agent to read local files and send their Base64-encoded contents to a remote server.
Evidence: The script reads files using open(args.upload_file, "rb") and transmits the data via an HTTP POST request in the uploads field. Although this is a core feature for RAG (Retrieval-Augmented Generation), it could be misused to exfiltrate sensitive files if the agent is successfully manipulated.

flowise-api