The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data (logs, traces, network artifacts) while having access to terminal and network tools.
Ingestion points: The agent is instructed in SKILL.md to read "captured artifacts", "network request payloads", and "event logs" from the filesystem to diagnose bugs.
Boundary markers: There are no structural prompt delimiters for external data; however, the skill explicitly mandates the use of <REDACTED> tags for secrets, which provides a manual layer of protection.
Capability inventory: The skill utilizes shell execution (bash), network clients (curl), and browser automation (Playwright, Puppeteer).
Sanitization: The framework relies on manual redaction instructions rather than automated escaping or schema validation for external artifacts.
[SAFE]: The skill incorporates a proactive security policy regarding credentials. In SKILL.md, it requires the agent to redact every secret and replace it with a <REDACTED> marker. It further encourages the use of environment variables for credentials to prevent them from appearing in output logs or command artifacts. The provided shell script scripts/hitl-loop.template.sh uses standard, safe shell practices (e.g., set -euo pipefail) for guiding user interaction.

diagnosing-bugs