The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions guide the user to install the langfuse-mcp server using uvx, which downloads and executes the package from a remote repository (PyPI). While Langfuse is a recognized service, this involves running code not contained within the skill itself.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and analyze historical AI traces and observations. These traces contain raw inputs and outputs from previous model interactions which may include attacker-controlled content designed to influence the current agent's behavior.
Ingestion points: Tools such as fetch_trace, fetch_observation, get_prompt, and list_dataset_items ingest external strings into the agent's context (referenced in references/tool-reference.md).
Boundary markers: The skill instructs the agent to treat data as "historical evidence" (in SKILL.md), but it lacks specific technical delimiters or explicit instructions to ignore embedded commands within those strings.
Capability inventory: The skill possesses capabilities to write to the file system (full_json_file mode), modify production prompts (update_prompt_labels), and perform network operations via the MCP server.
Sanitization: There is no evidence of automated sanitization or filtering of the ingested trace data before it is presented to the agent.
[DATA_EXFILTRATION]: The full_json_file output mode writes complete data payloads to the local file system. The skill explicitly warns that these exports can contain sensitive user data (found in SKILL.md and references/tool-reference.md), representing a local data exposure surface.
[COMMAND_EXECUTION]: The setup and troubleshooting documentation provide shell commands for adding MCP servers and verifying Python environments (e.g., uvx --python 3.14 langfuse-mcp --help), which require the execution of CLI tools.

langfuse