The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill indexes content from arbitrary local files (PDF, MD, Code) and feeds it into LLM prompts. This creates an attack surface where malicious documents can contain instructions intended to influence the agent's behavior.
Ingestion points: Content is retrieved from local document stores by rlama_retrieve.py and rlama_query.py.
Boundary markers: The skill uses basic metadata headers (e.g., '[document_id chunk N]') but lacks specialized delimiters to prevent the LLM from obeying instructions inside the documents.
Capability inventory: The system can perform network requests to cloud providers and execute a wide range of management commands via the rlama CLI.
Sanitization: Document content is concatenated into the prompt without sanitization or escaping.
[DATA_EXFILTRATION]: The skill supports synthesis via well-known external providers such as OpenRouter and TogetherAI. When these optional features are enabled, local document chunks are transmitted to these third-party cloud services.
[COMMAND_EXECUTION]: The skill's functionality relies on executing the external rlama CLI tool and various local Python scripts. The scripts use list-based arguments for subprocess calls, which is a safe practice to prevent shell injection.

rlama