The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from error logs and subagent messages to determine root causes and generate subsequent actions, which could be exploited to influence the agent's behavior.
Ingestion points: In SKILL.md (Step 1), the agent is instructed to read full error logs, terminal stderr, and subagent exit messages.
Boundary markers: The skill lacks explicit boundary markers or instructions to disregard embedded commands in the log content, relying instead on manual classification.
Capability inventory: The skill possesses bash execution and write_to_file capabilities, which are used to implement the generated recovery steps.
Sanitization: While references/circuit-breaker.md provides robust credential redaction (masking Bearer tokens, API keys, and database URLs), it does not filter for malicious natural language instructions.
[COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to verify system state, where the command itself may be influenced by the triaged failure.
Evidence: The 'Precondition Check' in SKILL.md and references/record-schema.md involves running a command or query to confirm the system is in a retryable state.
[DYNAMIC_EXECUTION]: The skill dynamically generates reproduction test packs which include executable code files that are then run by the agent.
Evidence: The 'Repro Test Pack' section in SKILL.md and the example in examples/sample-repro-pack.md demonstrate the generation of minimal failing test files (e.g., tests/lib/session.concurrency.test.ts) intended for execution via a test runner.

dead-letter