The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted user and assistant text for content moderation purposes, which naturally exposes an attack surface for indirect prompt injection.
Ingestion points: The moderate, check_input, and check_output functions in SKILL.md accept arbitrary string inputs from users and assistants to be evaluated by the LlamaGuard model.
Boundary markers: The code examples correctly utilize tokenizer.apply_chat_template to structure inputs, which provides formal contextual separation between different roles in the conversation.
Capability inventory: The skill's capabilities are limited to performing local model inference using the transformers and vllm libraries; it does not include functions for file system modification or unauthorized network communication.
Sanitization: No explicit input sanitization or escaping is performed on the input strings before they are passed to the model, as the model itself is the intended filtering mechanism.
[EXTERNAL_DOWNLOADS]: The skill fetches specialized moderation model weights from a well-known repository hosting service.
Evidence: The Python code uses AutoModelForCausalLM.from_pretrained("meta-llama/LlamaGuard-7b") and LLM(model="meta-llama/LlamaGuard-7b") to download and load pre-trained safety models provided by a trusted organization.

llamaguard