The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it processes untrusted content from extraction logs and external websites to guide its debugging logic.
Ingestion points: extraction-log.jsonl, output.wxr, and the source website content fetched via curl or WebSearch tools.
Boundary markers: Absent; there are no instructions to use delimiters or ignore instructions found within the logs or site content.
Capability inventory: The skill utilizes the Bash, Write, and Edit tools, allowing for command execution and file system modification.
Sanitization: No validation or sanitization steps are defined for data extracted from logs or external sites before it is interpreted or used in subsequent commands.
[COMMAND_EXECUTION]: The diagnostic process involves executing shell commands with variables derived from log files (e.g., curl -sI <failed-url> and npx tsx src/cli.ts inspect <site-url>). This pattern creates a command injection risk if the URLs or site data contain shell metacharacters and the agent fails to properly escape them before invocation.
[DATA_EXFILTRATION]: While intended for legitimate debugging of authentication and session issues, the skill specifically instructs the agent to inspect sensitive data including session cookies, localStorage, and window globals. This provides a mechanism for exposing credentials or session tokens to the agent context.

diagnose