The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several shell commands and system tools to gather diagnostic information.
Evidence: Uses curl for API testing, grep and sed for log processing, and docker logs for container diagnostics.
Evidence: Utilizes npx tsx and npx ts-node to execute local TypeScript diagnostic scripts.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to external endpoints associated with the Customer.io service.
Evidence: Fetches platform status from https://status.customer.io/api/v2/status.json.
Evidence: Performs authentication tests against track.customer.io and api.customer.io.
[REMOTE_CODE_EXECUTION]: The skill utilizes a pattern where data fetched from a remote URL is piped directly into a code interpreter for processing.
Evidence: In SKILL.md, platform status JSON is piped to python3 -c for parsing: curl -s "https://status.customer.io/api/v2/status.json" | python3 -c "import sys,json; ...".
[DATA_EXFILTRATION]: The skill is explicitly designed to collect and bundle sensitive system information, although it includes redaction steps.
Evidence: Reads application logs from /var/log/app/*.log and docker logs which may contain sensitive runtime data.
Evidence: Accesses environment variables including CUSTOMERIO_SITE_ID, CUSTOMERIO_TRACK_API_KEY, and CUSTOMERIO_APP_API_KEY for authentication tests.
[DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic execution markers to perform environment checks at load time.
Evidence: Uses !node --version and !npm list customerio-node in the SKILL.md frontmatter/header area to verify the environment immediately when the skill is accessed.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could contain malicious instructions.
Evidence: Ingestion points: Reads raw application logs (/var/log/app/*.log) and container logs which may contain content influenced by external users.
Evidence: Boundary markers: The scripts do not use specific boundary markers or "ignore instructions" delimiters when processing log content.
Evidence: Capability inventory: The skill has the ability to write files (/tmp/cio-debug-logs.txt), execute shell commands, and perform network operations via curl.
Evidence: Sanitization: Includes basic regex-based redaction using sed to remove API keys and secrets from the collected logs before bundling.

customerio-debug-bundle