The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the xcsym utility. It passes user-provided file paths directly to the command line (e.g., xcsym crash <file>). While typical for development-oriented agents, this pattern creates a surface for potential command injection if the execution environment does not strictly sanitize the input variable.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external crash logs, which constitute untrusted data.
Ingestion points: User-provided files or pasted text in various formats (.ips, .crash, .xccrashpoint, MetricKit JSON) are processed in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions that might be embedded within the crash log's text fields.
Capability inventory: The agent can execute shell commands (xcsym) and read/write files as part of its diagnostic workflow.
Sanitization: The skill lacks mechanisms to sanitize or filter the content of the crash reports (specifically fields like Application Specific Info) before the agent interprets them.
Risk: A malicious actor could embed prompt injection strings inside a crash log. If the agent "reads the raw output" or "interprets the JSON directly" as instructed, it might inadvertently execute commands or disclose information specified in the malicious log content.

axiom-analyze-crash