The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted external data.
Ingestion points: The $ARGUMENTS variable allows users or external triggers to provide arbitrary log file paths, error message text, or URLs (SKILL.md).
Boundary markers: Absent. The instructions do not specify delimiters or provide instructions for the agent to ignore potentially malicious commands embedded within the logs or URL content.
Capability inventory: The skill has access to Read, Grep, and Bash (specifically for git log and git diff), which could be leveraged if an injection attack successfully overrides the agent's instructions.
Sanitization: Absent. There is no validation or filtering of the content retrieved from the files or URLs before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill uses the Bash tool to execute git log and git diff commands.
Evidence: The allowed-tools field explicitly permits Bash(git log *) and Bash(git diff *) to allow the agent to inspect repository history during troubleshooting.
Risk: While these commands are restricted in scope, they grant the agent shell access to the file system, which could be misused if the agent is compromised via injection.
[DATA_EXFILTRATION]: The skill takes a file path as input and uses the Read tool to access it.
Evidence: The instructions tell the agent to "Read the specified log file" (SKILL.md).
Risk: A user or an automated process could provide a path to a sensitive file (e.g., ~/.ssh/id_rsa or .env) instead of a log file. The agent would then read and summarize this content, potentially exposing sensitive information in its output, although the 'Safety Precautions' section specifically instructs the agent not to include credentials in the output.

bug-triage