The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides several examples where untrusted external data is directly interpolated into prompts, creating an attack surface for indirect prompt injection.
Ingestion points: The text variable in extract_entities (OpenAI example) and the Claude structured output example in SKILL.md; the documents object in the LangChain RAG architecture example in SKILL.md.
Boundary markers: The RAG prompt uses simple labels like Context: {context} and Question: {question}, which are insufficient to prevent adversarial content within those fields from overriding instructions. The extraction examples lack any boundary markers for the {text} interpolation.
Capability inventory: The skill scripts perform network operations (OpenAI/Anthropic/Pinecone API calls) and local file system writes (FastAPI serving, vector database persistence in ./db and ./chroma_db).
Sanitization: No sanitization, escaping, or filtering of the external content is implemented before it is passed to the LLM.
[DYNAMIC_EXECUTION]: The MLOps serving example uses torch.load("model.pt"). In Python, torch.load uses the pickle module internally for deserialization. This is a known security risk as loading a maliciously crafted model file can lead to arbitrary code execution. While the example uses a local path, users should be warned about loading models from untrusted sources.

ai-ml-development