The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents numerous patterns for extracting structured data from untrusted external sources, such as job applications, invoices, and news articles. Ingestion points for potentially malicious instructions include variables like text, resume_text, and invoice_text found in SKILL.md and references/examples.md. While the Outlines library is specifically designed to constrain model output to a valid schema—thereby reducing the risk of an LLM generating executable malicious content—the input processing pipeline remains vulnerable to indirect injection. The examples demonstrate the use of boundary markers like Extract from:\n{text}\n\nData:, but do not include explicit sanitization or filtering logic for the untrusted input. The capabilities associated with these ingestion points are restricted to printing data and creating structured Python objects, which mitigates the immediate risk.
[REMOTE_CODE_EXECUTION]: The backend configuration guide in references/backends.md contains examples utilizing the trust_remote_code=True flag for vLLM and Transformers. This setting permits the execution of arbitrary Python code defined within the model repository. While this is a standard requirement for many contemporary model architectures hosted on platforms like Hugging Face Hub, it serves as a remote code execution vector if a user attempts to load a compromised or untrusted model repository.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and usage of pre-trained models from established machine learning organizations on Hugging Face Hub, including Microsoft, Meta (Llama), and Mistral AI. These downloads are performed through standard library calls to outlines.models.transformers and outlines.models.vllm as part of the intended functionality for local model inference.

outlines