The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a 'Fix loop' where the agent reads debug logs (.ndjson files) to identify and fix issues in the application. These logs contain data derived from external voice session events (e.g., server responses, client events). An attacker who can influence the content of these events could potentially inject instructions into the logs that the agent might follow when attempting to 'fix' the code.
Ingestion points: The agent reads logs from .voice-logs/<sessionId>.ndjson using jq.
Boundary markers: No specific boundary markers or instructions are provided to the agent to disregard commands within the log files.
Capability inventory: The agent has the capability to read project structure ('Map'), propose code changes ('Plan'), and modify application source code ('Install' and 'Fix loop').
Sanitization: The skill includes client-side redaction to remove raw audio and truncate long strings, but this does not prevent instructions from being processed as data.
[COMMAND_EXECUTION]: The skill uses shell commands for verification and log analysis, which involves interacting with the local environment and network interfaces.
Evidence: The 'Verify' section uses curl to send test data to the locally implemented logging sink. The 'Reading a log' section utilizes jq and sort for data processing.
[DATA_EXFILTRATION]: The skill is designed to capture and store application event data. While it explicitly forbids capturing sensitive credentials or raw audio, it still creates a repository of session metadata and interaction logs.
Evidence: The client logger hooks into session start, mic settings, and websocket events, transmitting this data to a local API endpoint (/api/voice/log) which saves it to the filesystem.

debug-voice