The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from document imports (PDF, DOCX, PPTX) and web clips to generate and update wiki pages. This provides a significant surface for indirect prompt injection where malicious content within a source could attempt to steer the agent's behavior during the 'analysis' or 'generation' stages.
Ingestion points: Document extraction logic in external/llm_wiki/src/lib/ingest.ts and the local clip server in external/llm_wiki/src-tauri/src/clip_server.rs.
Boundary markers: The generation prompt uses strict ---FILE: and ---END FILE--- delimiters to isolate LLM-generated file contents.
Capability inventory: The skill can perform file writes via commands/fs.ts, execute system commands via claude_cli.rs, and make network requests to various LLM and search APIs.
Sanitization: Includes robust path traversal protection in isSafeIngestPath and a document-level sanitizer in sanitizeIngestedFileContent.
[COMMAND_EXECUTION]: To support its features, the skill executes external binaries and scripts. It uses a Rust-based bridge to spawn the claude CLI as a child process and suggests the use of document processing tools like MinerU (mineru-md.sh) and Docling (docling-md.sh). These operations involve executing code from the system PATH or local project scripts.
[DATA_EXFILTRATION]: The skill starts a local HTTP server on 127.0.0.1:19827 to receive data from the companion web clipper. This server uses Access-Control-Allow-Origin: *, which allows any website the user visits to potentially interact with the local wiki daemon. Furthermore, the skill transmits potentially sensitive document excerpts to third-party LLM providers (OpenAI, Anthropic, Google) and search engines (Tavily, SerpApi) for synthesis and research purposes.

llm-wiki