The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection and path traversal due to how it handles log files.
Ingestion points: The skill uses the $ARGUMENTS variable in SKILL.md to identify a log file or a CI run ID.
Boundary markers: The instructions lack delimiters or warnings to treat the log content strictly as data, which could allow malicious content within the logs to influence the agent's behavior.
Capability inventory: The agent is tasked with reading files and potentially downloading artifacts from remote sources.
Sanitization: There is no validation or sanitization of the path provided in $ARGUMENTS, which could allow a user to specify sensitive system files for the agent to analyze.
[EXTERNAL_DOWNLOADS]: The skill instructions involve downloading artifacts from external sources.
Evidence: The description in SKILL.md specifies that for CI run IDs, the localnet-logs artifact should be downloaded first from the continuous integration provider.
[COMMAND_EXECUTION]: To perform the diagnosis, the agent must execute search and analysis commands on the provided logs.
Evidence: The skill defines a series of ordered checks, such as searching for specific error strings or log patterns, which requires executing file reading and pattern matching tools.

stall-postmortem