The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses dynamic context execution (!command) to retrieve the environment's Node.js version, Python version, and system information (uname -a) at load time. These are benign diagnostic commands used to verify the runtime environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from the Gamma API (https://public-api.gamma.app/v1.0/) through diagnostic and polling scripts. This creates a surface where the agent processes external, untrusted data.
Ingestion points: Step 2 and Step 3 scripts read JSON responses from the Gamma API.
Boundary markers: None explicitly defined for API response processing.
Capability inventory: The skill uses Bash, Write, and Edit tools.
Sanitization: Logged responses are truncated to 500 characters, but no explicit sanitization of content for prompt injection is performed.
[COMMAND_EXECUTION]: The skill provides Bash and TypeScript scripts that execute commands to perform network requests (curl) and process diagnostics. These are standard operations for an API debugging tool.
[CREDENTIALS_UNSAFE]: The diagnostic scripts access the GAMMA_API_KEY environment variable. The skill includes logic to print the first few characters of the key (e.g., ${GAMMA_API_KEY:0:4}) to verify it is set. While this exposes a fragment of the secret, it is a common debugging pattern and does not leak the full credential.

gamma-debug-bundle