The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, creating a surface for indirect prompt injection where malicious instructions inside documents could influence the agent's behavior.
Ingestion points: The DocumentLoader.loadFile and DocumentLoader.loadDirectory methods in SKILL.md read local file content, and WebLoader.loadUrl fetches content from external URLs.
Boundary markers: The pipeline lacks explicit boundary markers or instructions to treat loaded content as data only, potentially allowing the agent to follow instructions embedded within the indexed documents.
Capability inventory: The skill has the capability to read any local file path provided, fetch content from any URL, and send data to the OpenAI API for embedding generation.
Sanitization: Text processing includes cleaning and normalization (whitespace, unicode, special characters) but does not include security-specific sanitization to filter out prompt injection patterns.
[COMMAND_EXECUTION]: The skill uses Node.js filesystem APIs (readFile, readdir) to access the local environment.
Evidence: The DocumentLoader class uses fs/promises to read files and directories recursively, which could be used to access sensitive system files if the agent is directed to an inappropriate path.
[DATA_EXFILTRATION]: The skill performs network operations to fetch external data and send content to the OpenAI API.
Evidence: The WebLoader class uses the fetch API to retrieve content from arbitrary URLs, which could be leveraged for SSRF (Server-Side Request Forgery) or simple data exfiltration if the agent is instructed to fetch sensitive internal resources.

embedding-pipeline-builder