The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation instructions in SKILL.md and references/deployment.md recommend fetching specialized CUDA kernels from an external wheel index at flashinfer.ai. While this is standard for high-performance LLM serving, it involves downloading pre-compiled binaries from a third-party domain.
[INDIRECT_PROMPT_INJECTION]: Several SGLang functions demonstrated in the skill ingest untrusted external data (such as user queries or articles) directly into prompt templates. This creates a surface for indirect prompt injection where instructions embedded in the processed data could attempt to influence the agent's behavior.
Ingestion points: SKILL.md (functions: agent_workflow, structured_extraction, extract_person, extract_email, multi_turn_chat) and references/structured-generation.md (extract_structured_info, fill_form).
Boundary markers: The templates use simple prefixes like User: or Article:. These are present but may be insufficient to prevent an adversary from bypassing the context if the input contains conflicting instructions.
Capability inventory: The skill is primarily for text/JSON generation and serving; there is no evidence of the generated outputs being directly executed as system commands or code within the skill's own scope.
Sanitization: No explicit sanitization, escaping, or schema validation of the raw input variables is implemented before they are interpolated into the prompt strings.

sglang