The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions provide shell script templates that interpolate external data (stored in variables like $SEARCH, $CONTENT, and $EVIDENCE) directly into shell command arguments. Because these variables contain content retrieved from untrusted web searches, this pattern is susceptible to command injection if the content contains shell control characters such as backticks, semicolons, or unmatched quotes.
[INDIRECT_PROMPT_INJECTION]: The core RAG (Retrieval Augmented Generation) design of the skill ingests data from external sources (Tavily, Exa) and passes it to LLMs. The provided templates lack prompt boundary markers or sanitization logic, which allows malicious instructions hidden in retrieved web content to potentially override the agent's behavior. * Ingestion points: Search results from tavily/search-assistant and exa/search, and content from tavily/extract. * Boundary markers: None identified in the prompt templates. * Capability inventory: The skill is granted access to the Bash tool to execute the belt CLI, which performs network operations and interacts with various AI models. * Sanitization: No evidence of data sanitization or validation before interpolation into the prompt.
[EXTERNAL_DOWNLOADS]: The documentation directs users to download and install external tools, including the belt-sh/cli via npx and installation instructions hosted at raw.githubusercontent.com/inference-sh/skills.

ai-rag-pipeline