The Agent Skills Directory

[Indirect Prompt Injection] (MEDIUM): The skill implements query decomposition by passing raw user input to an LLM to extract search concepts.
Ingestion points: The query parameter in decompose_query and the QueryDecomposer.search method in SKILL.md.
Boundary markers: No delimiters (e.g., XML tags or triple backticks) are used to isolate user input from the system instructions.
Capability inventory: The extracted 'concepts' are passed to a search_fn callback. While primarily used for retrieval, an attacker could manipulate these concepts to perform unauthorized data discovery.
Sanitization: The input is used directly as provided, allowing an attacker to potentially override the LLM's instructions to return malicious search terms or bypass retrieval logic.

query-decomposition