The Agent Skills Directory

[DYNAMIC_EXECUTION]: Reference material in references/checkpoints-persistence.md includes a code example demonstrating how to implement custom state serialization using the pickle module. This module is inherently unsafe and can be leveraged to achieve arbitrary code execution if the serialized data is sourced from an untrusted environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture ingests external data that is directly used to populate agent prompts, creating an attack surface for indirect prompt injection.\n
Ingestion points: Untrusted content is ingested through url and raw_content fields in the AnalysisState, as seen in templates/content-analysis-graph.py and examples/example-analysis-workflow.md.\n
Boundary markers: The prompt templates for analysis agents, such as the SECURITY_AGENT_PROMPT in examples/example-analysis-workflow.md, lack strong delimiters or explicit instructions to ignore instructions embedded in the user-provided content.\n
Capability inventory: The workflow nodes possess capabilities including LLM generation, persistent database writes through checkpointers, and logging to external tracing services like Langfuse.\n
Sanitization: The implementation does not include sanitization, escaping, or structural validation of the external content before it is interpolated into LLM prompts using string formatting.

langgraph-workflows