The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to analyze external data such as error messages, stack traces, and logs to find root causes. This creates a surface for indirect prompt injection where malicious instructions could be embedded in data processed by the agent.
Ingestion points: The agent is instructed to "read_file Error Messages Carefully" and "read_file stack traces completely" (SKILL.md, Phase 1).
Boundary markers: None identified. The skill does not provide instructions to treat error content as untrusted or to use delimiters.
Capability inventory: The skill has access to shell execution (find-polluter.sh) and file system operations.
Sanitization: There are no instructions for sanitizing or escaping the content of logs or errors before the agent processes them.
[COMMAND_EXECUTION]: The skill includes a utility script for identifying test pollution which executes code.
Evidence: The file find-polluter.sh executes npm test "$TEST_FILE" within a loop based on a user-provided file pattern. While intended for debugging, this facilitates the execution of arbitrary test files found on the filesystem.
[DATA_EXFILTRATION]: Instrumentation techniques suggested in the skill involve accessing and displaying environment variables that may contain sensitive information.
Evidence: SKILL.md (Phase 1, Step 4) and root-cause-tracing.md suggest using env | grep_search IDENTITY to verify secret propagation. This pattern, while useful for debugging configuration issues, can lead to the accidental exposure of credentials in the agent's output or logs if not handled carefully.

systematic-debugging