The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides debugging instructions that involve logging environment variables and system state which may contain sensitive information. Specifically, the examples include using env | grep IDENTITY to verify secret propagation and security list-keychains to inspect the macOS keychain. If an agent follows these instructions, sensitive credentials or system configuration could be exposed in the agent's interaction history or external logging systems.
[INDIRECT_PROMPT_INJECTION]: The debugging workflow relies on the agent processing potentially untrusted data sources such as error messages, stack traces, and multi-component logs. The skill lacks guidance on using boundary markers or sanitizing this input, which could allow an attacker to influence the agent's behavior by embedding malicious instructions within system logs or error outputs. Ingestion points: Error messages, stack traces, and component boundary logs as specified in SKILL.md (Phase 1). Boundary markers: None identified; the agent is instructed to read diagnostic data directly into context. Capability inventory: File system access, shell command execution (e.g., npm test, codesign), and git operations. Sanitization: No content filtering or escaping is recommended for the ingested diagnostic data.
[COMMAND_EXECUTION]: The skill includes a utility script find-polluter.sh that executes npm test on files identified via a user-provided search pattern. It also suggests using various CLI tools like codesign and security for troubleshooting. These capabilities provide a vector for executing code within the user's environment, which should be monitored if the agent is operating on untrusted repositories.

systematic-debugging