The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external documents to build a persistent knowledge base (wiki and graph). This creates a surface for indirect prompt injection where malicious instructions embedded in documents could influence the agent's extraction or synthesis logic.
Ingestion points: The ingest_with_content method in scripts/contextgraph.py and the instructions in references/ingestion.md represent the primary ingestion points for untrusted data.
Boundary markers: The references/ingestion.md file, which guides the agent on how to extract data from documents, lacks explicit boundary markers (such as XML tags or specific delimiters) or instructions to ignore commands potentially embedded within the source content.
Capability inventory: The skill has the capability to write to the filesystem through scripts/tools/wiki_store.py (markdown pages) and scripts/tools/graph_store.py / scripts/tools/documents_store.py (JSON data files), meaning an injection could persist malicious data into the long-term knowledge base.
Sanitization: While the skill correctly uses slugification in scripts/tools/wiki_store.py to prevent path traversal when creating filenames, there is no sanitization of the content itself before it is processed by the LLM for synthesis and storage.

mini-context-graph