The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted external data, such as user-provided specifications, task descriptions, and bug reports, which creates a surface for indirect prompt injection.
Ingestion points: SKILL.md (authorized behavior/requirements) and references/diagnose.md (bug reports and captured traces).
Boundary markers: The skill relies on natural language instructions to define 'authorized' work and requirements.
Capability inventory: The skill possesses extensive capabilities including writing code to the filesystem, executing shell commands for testing and typechecking (SKILL.md), and running arbitrary scripts (curl, CLI, browser automation) for debugging (references/diagnose.md).
Sanitization: references/diagnose.md contains a dedicated 'Redact' section instructing the agent to replace secrets with <REDACTED> and avoid including auth headers or credentials in its output.
[COMMAND_EXECUTION]: The skill's primary function involves generating and executing various commands and scripts to verify code behavior.
Evidence: references/diagnose.md encourages the creation of 'feedback loops' using curl scripts, CLI invocations, and headless browser scripts (Playwright/Puppeteer).
Context: These operations are fundamental to the skill's intended purpose of software implementation and debugging.
[DATA_EXFILTRATION]: The skill instructions acknowledge the risk of exposing sensitive data during the debugging process.
Evidence: references/diagnose.md explicitly warns that captured artifacts may carry authentication headers and that credentials should remain in environment variables rather than being displayed.
Mitigation: The inclusion of mandatory redaction steps for secrets and auth headers serves as a behavioral guardrail against accidental data exposure.

implement