The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's RAG and ingestion templates (templates/rag-chat.ts, templates/document-ingestion.ts) present a surface for indirect prompt injection.
Ingestion points: The POST /ingest/url endpoint in document-ingestion.ts allows fetching content from arbitrary external URLs.
Boundary markers: The LLM prompts constructed in rag-chat.ts use simple markdown-like headers (Context: ${context}) which do not reliably isolate retrieved data from system instructions.
Capability inventory: The templates leverage env.AI.run to process instructions and fetch to retrieve external data.
Sanitization: Sanitization is limited to regex-based HTML tag removal, which is insufficient to strip malicious prompt instructions from ingested content.
[DATA_EXFILTRATION]: The document-ingestion.ts template contains a fetch(body.url) implementation. This creates a Server-Side Request Forgery (SSRF) surface, as a malicious user could provide internal URLs or use the worker to proxy requests to external domains, potentially leading to unauthorized data access or exfiltration of environment information.

cloudflare-vectorize