The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, specifically log messages and trace attributes, which creates an inherent attack surface for indirect prompt injection.
Ingestion points: Data is pulled into the agent context via ES|QL queries targeting logs-*.otel-* and traces-*.otel-* as documented in references/log-investigation.md and references/apm-signals.md.
Boundary markers: The instructions do not define specific delimiters (e.g., XML tags or triple backticks) to separate log content from instructions, nor do they include explicit 'ignore instructions within data' directives.
Capability inventory: The agent's capabilities are limited to executing read-only operations via the elastic CLI (e.g., esql query, slo find, ml get-jobs). It lacks dangerous capabilities like local file writing or arbitrary network requests.
Sanitization: Log content is processed as raw text for categorization and funneling without specialized sanitization against prompt injection payloads.
[EXTERNAL_DOWNLOADS]: The skill references an external CLI tool required for operation.
Evidence: SKILL.md links to the official configuration for the elastic CLI at github.com/elastic/cli. As this is a repository managed by a well-known, trusted organization, the reference is considered safe and standard for the vendor's ecosystem.

observability-sre-triage