The Agent Skills Directory

[PROMPT_INJECTION]: The skill's RAG and ingestion templates introduce a surface for indirect prompt injection attacks where untrusted data could influence model behavior.
Ingestion points: The /ingest/url endpoint in templates/document-ingestion.ts fetches content from arbitrary external URLs. Additionally, templates/rag-chat.ts and templates/basic-search.ts retrieve data from the Vectorize database for use in LLM prompts.
Boundary markers: The RAG implementation in templates/rag-chat.ts uses structural delimiters such as [Title]\nContent and --- to separate retrieved context from the system instructions. While helpful for structure, these markers do not prevent an LLM from obeying instructions embedded within the retrieved text.
Capability inventory: The templates have access to the env.AI.run capability for executing LLM completions and fetch for making network requests.
Sanitization: Basic regex is used in templates/document-ingestion.ts to remove HTML tags, but no natural language sanitization is performed to filter out malicious prompts or instructions from the fetched content.
[DATA_EXFILTRATION]: The skill provides code that performs network requests to user-supplied targets, which can be misused as a conduit for data or scanning.
Network operations: The /ingest/url route in templates/document-ingestion.ts accepts a URL from the request body and performs a server-side fetch. This represents a Server-Side Request Forgery (SSRF) vulnerability surface, as the code lacks an allowlist or validation to prevent the worker from requesting internal or sensitive resources.

cloudflare-vectorize