The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, potentially untrusted text data for structured extraction, creating an attack surface for indirect prompt injection.
Ingestion points: Multiple examples in SKILL.md, references/examples.md, and references/json_generation.md demonstrate ingesting raw text from external sources such as emails, resumes, news articles, and survey responses directly into the agent's prompt.
Boundary markers: The prompt templates utilize simple natural language delimiters (e.g., "Extract from: {text}\n\nData:") to separate external content from instructions. These markers may not be sufficient to prevent the agent from erroneously following commands embedded within the data.
Capability inventory: The skill enables the generation of structured JSON, SQL queries, and Python code blocks. If these outputs are consumed by downstream tools or executed without verification, the impact of a successful injection could be significant.
Sanitization: The provided examples do not include explicit sanitization, escaping, or specific instructions to the agent to disregard any commands or instructions found within the input data.
[REMOTE_CODE_EXECUTION]: The documentation in references/backends.md describes the use of the trust_remote_code=True parameter for the vLLM and transformers backends. This configuration allows for the loading and execution of arbitrary Python code included in the target model's repository. While the examples provided reference models from well-known and trusted organizations, users should be aware of the security implications of enabling this flag when working with untrusted or unknown model repositories.

outlines