The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text data that is subsequently interpolated into LLM prompts without explicit sanitization or strict boundary delimiters. This is a common architectural pattern in LLM orchestration that presents a risk of hijacking model behavior if the input contains adversarial instructions.
Ingestion points: The review field in the SentimentClassify signature within example_pipeline.py directly accepts user-provided text.
Boundary markers: The skill relies on the default DSPy signature formatting and does not implement additional delimiters or instructions to ignore embedded commands.
Capability inventory: The agent has the capability to write files to the local directory (runs/, artifacts/) and perform network requests to LLM provider APIs.
Sanitization: No sanitization or validation of the input text is performed before it is processed by the model.
[DYNAMIC_EXECUTION]: The skill demonstrates the use of DSPy's serialization features for saving and loading program artifacts. Specifically, the save_program=True parameter in the save() method serializes the Python module code itself.
Evidence: Both SKILL.md and reference.md provide examples of optimized.save(..., save_program=True) and describe loading via dspy.load().
Impact: Loading a serialized program artifact (typically using cloudpickle or pickle) from an untrusted or tampered source could lead to arbitrary code execution on the host machine.
Mitigation: The skill documentation identifies this risk and explicitly recommends using save_program=False for production environments to separate the optimized instructions from the executable code.

dspy-advanced-workflow