The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation in SKILL.md and references/deployment.md includes default passwords for core infrastructure components, specifically MYSQL_PASSWORD and MINIO_PASSWORD set to infini_rag_flow.
[COMMAND_EXECUTION]: The skill instructs users to perform privileged system modifications using sudo, specifically to adjust vm.max_map_count for Elasticsearch requirements.
[REMOTE_CODE_EXECUTION]: The deployment guide requires users to clone an external repository (github.com/infiniflow/ragflow) and execute internal scripts such as download_deps.py and launch_backend_service.sh.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading software and configuration from various external sources, including GitHub, Docker Hub, and several Chinese mirror registries for Docker images and HuggingFace models.
[DATA_EXFILTRATION]: The skill exposes a vulnerability surface for Indirect Prompt Injection due to its core functionality of ingesting and parsing untrusted documents (PDF, DOCX) and integrating with external search tools. These ingested instructions could potentially exploit the skill's "Code Executor" and "SQL Executor" capabilities to influence agent behavior or exfiltrate data via tool outputs.
Ingestion points: Document import commands in SKILL.md and references/cli-reference.md; Web Search component in references/architecture.md.
Boundary markers: No specific prompt boundary delimiters or "ignore instructions" warnings are documented for handling external content.
Capability inventory: File system access (MinIO), network egress (API calls, Search), and dynamic code execution (gVisor sandbox) as described in references/architecture.md.
Sanitization: The documentation notes that code execution is isolated within a gVisor-based sandbox.

open-ragflow