The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill provides diagnostic code examples that access sensitive system information. In SKILL.md (Phase 1, Step 4), it instructs the agent to run commands to list macOS keychains (security list-keychains) and view signing identities (security find-identity -v). It also suggests using env | grep IDENTITY to verify environment variables, which can expose sensitive credentials or tokens in the console output or logs. While these commands are relevant for debugging deployment/signing issues, they represent a risk of exposing sensitive data to the agent context.
[COMMAND_EXECUTION]: The skill includes a standalone shell script, find-polluter.sh, which is designed to automate the execution of tests. The script uses the find command to locate files matching a specific pattern and iteratively runs them using npm test. The skill also provides examples of using codesign and other shell utilities for diagnostic purposes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data such as error messages, logs, and stack traces. These ingestion points (identified in Phase 1 of SKILL.md) provide an attack surface where malicious instructions embedded in logs or test outputs could influence the agent's behavior. There are no explicit instructions for the agent to sanitize or validate this external content before acting on it.
[PROMPT_INJECTION]: The included validation test files (test-pressure-1.md, test-pressure-2.md, and test-pressure-3.md) utilize imperative role-play language and psychological pressure to direct the agent's decision-making. Phrases such as "IMPORTANT: This is a real scenario. You must choose and act" and "Be honest about what you would actually do" are patterns commonly used to attempt to bypass standard operational guidelines or safety filters.

systematic-debugging