The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from various artifacts which presents a surface for indirect prompt injection, particularly as the agent is granted significant execution capabilities.
Ingestion points: The agent reads GLOSSARY.md, architecture decision records (ADRs), HAR files, log dumps, and network traces provided by the user or found in the codebase (SKILL.md).
Boundary markers: While the skill provides a workflow for processing data, it lacks explicit instructions to ignore or escape instructions that might be embedded within the artifacts being analyzed.
Capability inventory: The agent is authorized to execute shell commands, curl scripts, test suites, git bisect routines, and headless browser automation (SKILL.md).
Sanitization: The skill includes a dedicated 'Redact' section that mandates replacing secrets with <REDACTED> and filtering auth headers, which effectively mitigates data exposure but does not address instruction injection.
[DYNAMIC_EXECUTION]: The skill requires the agent to generate and run temporary code and scripts for the purpose of reproducing bugs.
Evidence: Instructions in Phase 1 and Phase 4 include creating 'throwaway harnesses', 'headless browser scripts', and shell scripts using the provided scripts/hitl-loop.template.sh (SKILL.md).
[COMMAND_EXECUTION]: The core functionality of the skill involves executing various system commands and developer tools.
Evidence: The workflow explicitly uses git bisect run, curl, and various test runners (CLI, unit, integration) to establish and tighten feedback loops (SKILL.md).

diagnosing-bugs