The Agent Skills Directory

[METADATA_POISONING]: The skill's metadata identifies the author as 'https://github.com/Jeffallan', which contradicts the provided vendor context of 'alismx'. This discrepancy indicates a potential integrity issue with the skill's source information.
[COMMAND_EXECUTION]: The skill provides numerous examples and instructions for the agent to execute system profiling and monitoring commands, including 'clinic', 'py-spy', 'pprof', and 'async-profiler'. While these are standard tools for a monitoring expert, they involve executing binary tools on the host system.
[EXTERNAL_DOWNLOADS]: The instructions direct the installation of several external packages from public registries (NPM and PyPI) and the use of external profiling scripts (e.g., 'profiler.sh').
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze structured logs, traces, and performance metrics, which often contain data from untrusted external sources (e.g., HTTP User-Agents, request paths, and error messages). This creates a surface for indirect prompt injection if the agent interprets this data as instructions.
Ingestion points: Log data containing 'userAgent' and 'ip' (references/structured-logging.md), and tracing spans containing 'order.id' and exception messages (references/opentelemetry.md).
Boundary markers: None identified in the instructions for data analysis or processing.
Capability inventory: Subprocess execution for profiling tools, network requests for load testing and metrics scraping, and file system writes for snapshots and reports.
Sanitization: The skill lacks explicit instructions for sanitizing or escaping untrusted content before analysis.

monitoring-expert