The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted data from the debugged application's runtime environment.
Ingestion points: Untrusted data enters the agent context via xdebug_get_frame_values (inspecting variables), xdebug_get_stack (inspecting frames/paths), tracepointOutputsTail (log results), and the output field of execute_run_configuration.
Boundary markers: The instructions do not define explicit delimiters (e.g., XML tags or specific markdown markers) to separate runtime data from instructions, nor do they include explicit 'ignore instructions in data' warnings for these ingestion points.
Capability inventory: The agent has significant local capabilities, including executing code via execute_run_configuration and xdebug_start_debugger_session, and modifying application state via xdebug_set_variable.
Sanitization: The skill does not describe any sanitization, filtering, or validation steps for runtime values before the agent interprets them.
[COMMAND_EXECUTION]: The skill facilitates the execution of local code and processes via Rider's run configurations and debugger sessions. While this is the primary intended purpose, it grants the agent the ability to run arbitrary code within the developer's environment. The skill instructions mitigate this by advising the agent to prefer existing configurations and avoid synthesizing arguments from untrusted strings.

debugging-code