The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest, summarize, and synthesize information from untrusted external documents provided by the user. This creates a surface where malicious instructions embedded in those documents could influence the agent's behavior during ingestion or subsequent query operations.
Ingestion points: Untrusted source files are read from the raw/ directory as specified in references/workflows/ingest.md.
Boundary markers: The workflows do not specify the use of clear delimiters or instructions to ignore embedded natural language commands when processing source text.
Capability inventory: The agent has the capability to write and modify files within the wiki/ directory and execute shell commands using the local search script.
Sanitization: There is no evidence of content sanitization to filter out potentially malicious instructions from the source material before it is incorporated into the persistent knowledge base.
[DYNAMIC_EXECUTION]: The skill automates the setup of a search layer by generating a Python script from an internal template and then executing it.
Evidence: The workflow in references/workflows/bm25.md describes copying references/templates/wiki_fts.py to scripts/wiki_fts.py and executing it via python3 to build and search the index. While the template itself is part of the skill and appears benign, the pattern of script generation and execution is a documented risk factor.

llm-wiki-bootstrap