The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes a data ingestion and retrieval workflow (RAG) that is susceptible to indirect prompt injection attacks.
Ingestion points: The cognee-cli remember command accepts arbitrary text, local file paths, and remote URLs as input to be processed and indexed into the memory graph.
Boundary markers: The documentation does not mention the use of delimiters or specific instructions to the agent to ignore embedded commands within the ingested content, which could allow malicious instructions to be retrieved later.
Capability inventory: The recall command uses an LLM to query the indexed graph, and improve bridges session history into the graph. These capabilities provide a mechanism for malicious data fetched during ingestion to influence the agent's future responses or actions.
Sanitization: There is no evidence of sanitization or validation performed on data fetched from remote URLs or local files before it is processed by the indexing pipeline.
[COMMAND_EXECUTION]: The skill documents a CLI tool (cognee-cli) that interacts with the file system and network.
File system access: Commands like remember read from the local file system, and config set writes configuration data to .env files in the current working directory.
Network operations: The remember command can be instructed to fetch data from arbitrary remote URLs, and the serve command establishes connections to remote API instances.
Destructive actions: The forget --all command is documented as deleting all datasets immediately without a confirmation prompt, even on non-interactive inputs. This could be exploited to cause data loss if an agent is manipulated into executing the command.
[CREDENTIALS_UNSAFE]: The CLI provides a mechanism to view sensitive configuration values that are normally protected.
Secret exposure: The cognee-cli config get --show-secrets command explicitly allows the retrieval of all configuration keys, including LLM_API_KEY. If an agent is directed to run this command and output the results, it leads to the exposure of sensitive credentials.
[EXTERNAL_DOWNLOADS]: The remember command allows the agent to fetch content from remote URLs to add to its memory. While intended for data ingestion, this represents a network operation that can target any domain.

cognee-cli