The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process third-party material such as web search results, GitHub issue bodies, and API documentation during its 'Research phase'. This introduces a potential attack surface for indirect prompt injection if external sources contain malicious instructions.
Ingestion points: The 'Research phase' described in SKILL.md utilizes subagents to perform web searches and fetches.
Boundary markers: The skill explicitly defines an 'Untrusted content boundary' section with instructions to treat retrieved text as data, use <EXTERNAL_DATA> delimiters, and ignore embedded requests to run tools or reveal secrets.
Capability inventory: The skill environment allows shell command execution (e.g., npm test via find-polluter.sh) and network operations.
Sanitization: Instructions include capping content size, validating URLs, and requiring user confirmation for sensitive actions like uploads or publication.
[COMMAND_EXECUTION]: The find-polluter.sh script executes npm test on files discovered within the local directory based on a user-provided pattern. This is a standard functional component for identifying test pollution but involves the execution of local code.
[EXTERNAL_DOWNLOADS]: The skill's 'Research phase' involves fetching external content from the web, specifically searching GitHub issues and authoritative documentation to provide context for debugging sessions.

systematic-debugging