The Agent Skills Directory

[DATA_EXFILTRATION]: A feedback collection mechanism in scripts/lib/feedback.py sends data to a hardcoded Google Form. The data includes a 'context' field which, per instructions in SKILL.md, can contain error messages or previous commands. Although user consent is required and a preview is shown, this channel could inadvertently leak sensitive session details if not carefully reviewed by the user.
[INDIRECT_PROMPT_INJECTION]: The skill features an extensive RAG (Retrieval-Augmented Generation) surface. It processes unstructured documents (PDFs) in scripts/lib/ingest.py and application logs/traces in observability/. These inputs are interpolated into LLM prompts in scripts/lib/search.py and scripts/lib/operations.py to synthesize answers and generate OpenSearch queries. Malicious content within these processed documents or logs could attempt to influence the agent's logic or tool parameters.
Ingestion points: scripts/lib/ingest.py (PDF text extraction), scripts/lib/search.py (search hits from OpenSearch indices).
Boundary markers: Not explicitly defined in the LLM connector actions or prediction bodies.
Capability inventory: OpenSearch API operations (read/write), ML model management, and Docker container control via scripts/lib/client.py.
Sanitization: Standard text normalization is applied, but no specific prompt-injection defenses are present.
[COMMAND_EXECUTION]: The skill executes shell commands using subprocess for operational tasks. scripts/lib/client.py manages local OpenSearch Docker containers, scripts/lib/ingest.py handles background processing, and scripts/lib/ui.py uses lsof to manage the UI server port. These commands generally use static binary paths and well-defined arguments.
[EXTERNAL_DOWNLOADS]: scripts/lib/samples.py downloads sample datasets from IMDb and scripts/opensearch_ops.py fetches documentation from GitHub. These operations target well-known domains and implement SSRF (Server-Side Request Forgery) protections by validating that resolved IP addresses are public and non-restricted.
[CREDENTIALS_UNSAFE]: scripts/lib/client.py includes a hardcoded default password ('myStrongPassword123!') used for initial configuration of local development environments. While appropriate for isolated local testing, this value is also used by the client for default authentication attempts if not overridden by environment variables.

opensearch-skills