The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes several files (test-pressure-1.md, test-pressure-2.md, test-pressure-3.md) that utilize injection-style language, including 'IMPORTANT: This is a real scenario', 'You must choose and act', and 'Don't ask hypothetical questions', which are designed to override the agent's internal reasoning and force specific role-play behaviors.
[COMMAND_EXECUTION]: The provided script find-polluter.sh executes npm test on files discovered via the find command based on user-supplied patterns, which could lead to the execution of malicious code if the filesystem contains crafted test files.
[DATA_EXFILTRATION]: The SKILL.md file contains instructions for diagnostic instrumentation that involve accessing sensitive system information, such as environment variables (env | grep IDENTITY) and macOS keychain details (security list-keychains, security find-identity -v).
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and 'read carefully' error messages, stack traces, and logs from multi-component systems. This creates a vulnerability where instructions embedded in those external data sources could influence the agent's behavior, especially given the lack of sanitization guidance.
Ingestion points: Error messages, logs, stack traces, and component boundary outputs as described in SKILL.md (Phase 1).
Boundary markers: Absent; the instructions mandate a 'complete' reading of the data without delimiters.
Capability inventory: The skill uses subprocess execution through npm test, codesign, and security tools.
Sanitization: None; the skill provides no instructions for escaping or validating the content of the logs or errors it processes.

systematic-debugging