The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a Retrieval-Augmented Generation (RAG) architecture that is susceptible to indirect prompt injection attacks.
Ingestion points: The templates/document-ingestion.ts file includes an endpoint (POST /ingest/url) that fetches content from arbitrary user-provided URLs and stores the processed text in the vector database.
Boundary markers: The RAG prompt in templates/rag-chat.ts uses simple 'Context:' headers and delimiters to separate retrieved data from system instructions. These markers do not provide robust protection against adversarial content designed to hijack the model's behavior.
Capability inventory: The skill possesses the capability to query the VECTORIZE_INDEX and the AI (LLM) service. Malicious content ingested via a URL could potentially influence the LLM's output or cause it to ignore safety guidelines during a chat session.
Sanitization: The ingestion pipeline performs minimal text cleaning (stripping HTML tags via regex), which does not remove or mitigate malicious natural language instructions embedded within the fetched content.

cloudflare-vectorize