The Agent Skills Directory

[PROMPT_INJECTION]: The chat endpoint in src/ai_service/api/endpoints/chat.py directly interpolates user-provided text into the message list sent to the LLM without applying protective delimiters or specific instructions to ignore malicious prompt injection attempts.
[INDIRECT_PROMPT_INJECTION]: The skill features a SQL Agent that translates natural language into database queries, creating a surface for indirect prompt injection.
Ingestion points: User input is ingested via the ChatRequest model in src/ai_service/api/endpoints/chat.py and passed to SQLAgent.query in src/ai_service/agents/sql_agent.py.
Boundary markers: The SQL_SYSTEM_PROMPT provides high-level instructions to only generate SELECT queries, but there are no structural delimiters separating user content from system instructions.
Capability inventory: The agent possesses the capability to execute arbitrary SQL queries (filtered) against a configured database using the SQLAlchemy-based SQLQueryTool in src/ai_service/tools/sql_tool.py.
Sanitization: The SQLQueryTool implements basic blocklist-based sanitization, checking for keywords like DELETE, DROP, and UPDATE. However, it relies on simple string matching which may be bypassed by sophisticated SQL injection or database-specific syntax.

ai-ml