The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a shell script (Debug Collection Script) designed to be executed by the agent. This script performs multiple system operations including directory creation, file writing, and archiving via tar.
[EXTERNAL_DOWNLOADS]: The skill uses curl to fetch data from the external Finta API (api.finta.io). While these downloads are part of the diagnostic process, they involve retrieving external JSON payloads into the local environment.
Evidence: curl -s -H "Authorization: Bearer ${FINTA_API_KEY}" "https://api.finta.io/v1/investors?limit=10" > "$BUNDLE/investors-sample.json"
[DATA_EXFILTRATION]: The skill accesses the FINTA_API_KEY environment variable and transmits it via an Authorization header to api.finta.io. Additionally, it collects sensitive investor information and fundraising data, storing them in local files which could lead to unauthorized data exposure if the resulting archive is mishandled.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external API responses, which could potentially contain malicious content designed to influence the agent's behavior during analysis.
Ingestion points: API responses from https://api.finta.io/v1/ for rounds, investors, and integrations.
Boundary markers: The documentation instructs the user to redact sensitive information, but the scripts themselves do not implement automated boundaries or markers to isolate the fetched data.
Capability inventory: Shell script execution, network requests, file system modification, and data analysis using jq and grep.
Sanitization: No programmatic sanitization or validation of the API data is present in the provided scripts.

finta-debug-bundle