The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to retrieve and display traces and spans from LLM applications. These data structures contain raw input and output strings from external users. If a trace contains malicious instructions, the agent reading the trace could potentially follow them.
Ingestion points: Commands such as px trace get, px span list, and px session get fetch untrusted content into the agent's context.
Boundary markers: The skill suggests using --format raw and piping to jq, but does not provide specific instructions to the agent to treat trace content as untrusted data.
Capability inventory: The agent has full access to the px CLI, including the ability to delete resources, modify configurations, and interact with the GraphQL API.
Sanitization: No explicit sanitization of the trace data is performed before it is presented to the agent.
[COMMAND_EXECUTION]: The skill provides the agent with extensive access to the system via the px (Phoenix CLI) tool. This includes commands for authentication, profile management (which modifies ~/.px/settings.json), and resource deletion. While these are legitimate tool functions, the agent has significant control over the Phoenix environment and local configuration.

phoenix-cli