The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is RAG, which involves processing potentially untrusted data from various sources.
Ingestion points: aiDocuments() in SKILL.md can load data from local directories, HTTP/HTTPS URLs, RSS/Atom feeds, SQL databases, and web crawlers.
Boundary markers: The example implementation in SKILL.md uses simple delimiters (e.g., Answer using only this context:\n\n#context#) to separate retrieved data from instructions, which can be bypassed by sophisticated injection attacks.
Capability inventory: The skill uses aiChat() and aiAgent() in SKILL.md to process the ingested content and allows retrieval to be exposed to agents as a tool via aiTool().
Sanitization: The documentation and examples do not include explicit sanitization or filtering logic for the content retrieved from documents before it is interpolated into the AI prompt.
[DATA_EXFILTRATION]: The skill provides the agent with extensive access to local and remote data sources, which could be misused to expose sensitive information.
Local file access: The DirectoryLoader and TextLoader (default for aiDocuments) can read arbitrary file paths on the local system.
Database exposure: The SQLLoader allows executing SQL queries against configured datasources to retrieve data for the AI context.
Network operations: The HTTPLoader, FeedLoader, and WebCrawlerLoader make outbound network requests to fetch data from external domains.
[DYNAMIC_EXECUTION]: The loader system supports dynamic instantiation of classes by path.
Evidence: In SKILL.md, the documentation states that "A full class path is also accepted as type" for aiDocuments(), allowing the instantiation and execution of arbitrary loader classes (e.g., bxModules.bxai.models.loaders.PDFLoader).

bx-ai-rag