The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core workflow for postmortem generation.
Ingestion points: The workflow in SKILL.md (Step 8) and templates in references/incident-analysis.md and references/incident-command.md ingest external, untrusted data such as incident titles, descriptions, and root cause answers.
Boundary markers: The postmortem template in SKILL.md uses standard curly brace placeholders {{ incident_title }} without clear delimiters or instructions for the AI to ignore instructions embedded within those data fields.
Capability inventory: The agent uses this data to generate complex markdown documents, Grafana JSON configs, and Prometheus YAML rules, providing a wide surface for influencing the agent's output formatting or behavior.
Sanitization: The instructions do not specify any validation, filtering, or escaping for the external content before it is interpolated into the postmortem artifact.
[COMMAND_EXECUTION]: Reference implementations provided for users contain patterns for executing external shell commands.
Evidence: references/error-budget-policy.md includes a Python script (auto_rollback.py) that uses the subprocess.run library to execute a hypothetical CLI tool named deployctl. While this is presented as a reference for the user, it demonstrates a capability for spawning subprocesses with arguments derived from external API responses.
[OBFUSCATION]: Several reference files (architecture-patterns.md, code-organization.md, deployment-pipelines.md, error-handling.md, performance-optimization.md, security-best-practices.md, state-management.md, and testing-strategies.md) contain 150 sections each consisting of repetitive boilerplate text and shuffled code snippets. While not confirmed to hide malicious data, this extreme padding is a known technique for making manual auditing difficult and potentially bypassing context-window-based scanning logic.

devops-sre-practices