The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Automated security scans detected the documentation URL 'https://jeffallan.github.io/claude-skills/skills/data-ml/rag-architect/' as malicious (Blacklisted). Although this is a vendor-related domain, the blacklist status indicates a security risk.
[REMOTE_CODE_EXECUTION]: In references/chunking-strategies.md, the skill uses AutoModel.from_pretrained with the trust_remote_code=True parameter for the jinaai/jina-embeddings-v2-base-en model. This allows the library to download and execute custom code from the remote Hugging Face repository.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (documents and user queries) to build RAG pipelines. This creates an attack surface where malicious instructions hidden in documents could influence the agent's behavior during retrieval or generation.
Ingestion points: raw_docs in SKILL.md; document_text in references/chunking-strategies.md.
Boundary markers: None explicitly defined in the provided code snippets to isolate data from instructions.
Capability inventory: Extensive network operations (OpenAI, Qdrant, Cohere, Pinecone, Weaviate), local file processing, and vector database management.
Sanitization: Minimal cleaning (whitespace removal and basic character stripping) is shown in the clean_for_embedding function, which is insufficient for preventing prompt injection.

rag-architect