The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a RAG architecture that fetches content from external sources (Tavily, Exa) and feeds it into Large Language Models, creating a surface for indirect prompt injection.
Ingestion points: Untrusted data from web search results is captured in variables such as $SEARCH_RESULT, $CONTENT, and $EVIDENCE within SKILL.md.
Boundary markers: The prompt templates use basic textual headers like 'Search Results:' and '== Overview ==', but they lack robust delimiters or instructions for the model to ignore potential commands embedded in the retrieved content.
Capability inventory: The skill leverages the belt CLI tool to execute various inference and search applications, which is documented in the allowed-tools configuration.
Sanitization: There is no evidence of content filtering, escaping, or validation performed on the external data before it is interpolated into the prompts.
[COMMAND_EXECUTION]: The skill documentation and templates provide numerous examples of executing shell commands using the belt CLI to interact with the Inference.sh platform. This includes operations for logging in, running search assistants, and invoking LLM models.

ai-rag-pipeline