The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted chat history to update long-term storage, potentially allowing embedded malicious instructions to influence future agent behavior. \n
Ingestion points: Chat session content is retrieved via session_search (SKILL.md). \n
Boundary markers: The instructions lack explicit delimiting or instructions to ignore commands within the session data. \n
Capability inventory: The agent can write to local SQLite databases (memory tool), update markdown files (MODEL_CARD.md), execute session deletion commands, and send data to Qdrant. \n
Sanitization: extractor_gate.py performs quality checks on text length and keyword substance but does not filter for prompt injection. \n- [COMMAND_EXECUTION]: The skill instructs the agent to offer the execution of the hermes sessions delete command to remove chat logs (SKILL.md). \n- [DATA_EXFILTRATION]: Extracted session data is sent to a Qdrant database. While defaulting to localhost, the QDRANT_URL environment variable allows directing this data to arbitrary remote endpoints (upsert.py). \n- [EXTERNAL_DOWNLOADS]: The upsert.py script utilizes sentence-transformers which downloads pre-trained embedding models from public repositories upon initialization.

exstraktor