The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill includes a script scripts/obs_http.py that reads the user's global configuration file at ~/.claude.json. This file contains sensitive API keys and environment variables for all configured MCP servers. While intended to facilitate authentication for sub-agents that do not inherit MCP server configurations, accessing this central configuration file exposes the user's entire secret store to the skill's execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data including Grafana logs, Sentry events, and CI failure logs.
Ingestion points: Data is pulled into the agent context via mcp__grafana__query_loki_logs, mcp__sentry__get_sentry_event_details, gh run view --log-failed, and the obs_http.py helper script.
Boundary markers: The instructions define structured reporting formats for sub-agents, but lack explicit delimiters or warnings to ignore potentially malicious instructions embedded in the fetched logs or error messages.
Capability inventory: The skill has broad capabilities including Bash execution, filesystem Write access, and the ability to spawn further sub-agents (Agent tool).
Sanitization: No sanitization of external log content or Sentry event data is performed before it is analyzed by the sub-agents.
[COMMAND_EXECUTION]: The skill makes extensive use of powerful CLI tools including kubectl, terraform, git, and gh. Although it mandates internal "hard rules" for read-only operation (e.g., requiring terraform plan to use -lock=false), the presence of these tools in an environment processing untrusted external data represents a significant attack surface.

rca