ai-rag-pipeline

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill is a legitimate RAG pipeline guide, but its top-line install command points to a different vendor namespace (belt-sh/cli) than the inference-sh skills it uses everywhere else, which is a possible lookalike source that the agent could be steered to install, though the intent is unclear.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow runs Tavily and Exa web searches and URL extraction, then feeds the returned arbitrary web page text into an LLM prompt, so outsiders can publish poisoned content that the agent retrieves, but an attacker cannot force delivery into a queue or feed.