The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input via the $ARGUMENTS placeholder within <investigation_request> tags. This content is used to define the interpretations and success criteria for the investigation.
Ingestion points: SKILL.md (via the $ARGUMENTS placeholder).
Boundary markers: The input is wrapped in XML-style tags, providing some structural separation, but there are no explicit instructions to ignore or sanitize embedded instructions within the user input.
Capability inventory: The skill allows for arbitrary shell command execution (Step 2), source file reading (Step 3), and system diagnostic discovery (Step 0).
Sanitization: There is no explicit sanitization of the user input before it is used to drive the agent's investigation logic.
[COMMAND_EXECUTION]: The skill is designed to interact with the host system by executing commands. In Step 0, it performs discovery using command -v for tools like curl, strace, and docker. In Step 2, it explicitly requires the agent to execute the same operation the user performed to reproduce the reported failure firsthand.
[DATA_EXFILTRATION]: To fulfill the evidence-chain protocol, the skill reads source files (Step 3) and captures full command outputs (Step 2), including stdout and stderr. While these actions are intended for debugging, they provide a mechanism for accessing sensitive files or environment data if the investigation target is manipulated by a malicious user.

find-cause