The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content (PDFs, web pages, videos, audio), creating a surface for indirect prompt injection where malicious instructions embedded in these sources could influence the agent's behavior.
Ingestion points: The skill provides multiple methods to ingest untrusted data, specifically through the POST /api/sources endpoint documented in references/api_reference.md and demonstrated in scripts/source_ingestion.py.
Boundary markers: The instructions do not define explicit boundary markers or provide the agent with guidance to ignore instructions contained within the ingested research materials.
Capability inventory: The skill utilizes requests to call API endpoints like /api/chat/execute and /api/transformations/execute, which process the untrusted ingested data using LLMs to generate summaries, notes, and chat responses.
Sanitization: No evidence of content sanitization or instruction filtering was found in the provided skill scripts or documentation.
[EXTERNAL_DOWNLOADS]: The skill instructions direct the user to download configuration files from a third-party repository not associated with the agent's trusted providers.
Evidence: SKILL.md and references/configuration.md contain instructions to download a Docker Compose file via curl -o docker-compose.yml https://raw.githubusercontent.com/lfnovo/open-notebook/main/docker-compose.yml.
[COMMAND_EXECUTION]: The skill provides shell commands for deployment and environment setup, which involves executing downloaded configurations.
Evidence: Instructions in SKILL.md include running docker-compose up -d after downloading the external YAML configuration.
[DYNAMIC_EXECUTION]: The included test suite performs dynamic code compilation to verify the validity of example scripts.
Evidence: The file scripts/test_open_notebook_skill.py uses the compile() function within the _check_script method to perform syntax checks on Python files in the scripts/ directory.

open-notebook