The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from an external source (Sentry) to drive code modifications.
Ingestion points: Sentry issue summaries, descriptions, and stack traces retrieved via mcp__sentry__get_sentry_resource in SKILL.md.
Boundary markers: Absent. The instructions do not explicitly tell the agent to ignore or delimit instructions that might be embedded within the Sentry error data.
Capability inventory: The skill has the capability to read/edit the entire local codebase, execute shell commands for project quality gates (e.g., PHPStan, Pint), and perform Git commits.
Sanitization: Absent. The skill processes external tool outputs directly without validation or filtering for potential injection strings.
Mitigation: The skill implements a robust mitigation in step 4d ('Propose fix — wait for approval'), which forbids any code modification or command execution for fixes until the user has explicitly reviewed and approved the proposed diff.
[COMMAND_EXECUTION]: The skill performs command execution as part of its verification workflow.
In step 4e, the agent is instructed to run the project's quality gates such as PHPStan, Pint, or tests.
While these are standard development tools, they are executed based on the context of the fix being implemented, which could be influenced by the aforementioned indirect injection.

sentry-triage