The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process 'traces' which contain untrusted data originating from end-user interactions, feedback comments, and application logs.
Ingestion points: Data enters the context via langwatch trace search, langwatch trace facets, and langwatch trace get commands in SKILL.md.
Boundary markers: The skill lacks explicit instructions to treat the content of these traces as untrusted data or to use delimiters to prevent the agent from following instructions embedded within trace text.
Capability inventory: The agent has the capability to execute shell commands, write files, and interact with the UI, which could be targeted if a malicious trace is processed.
Sanitization: While the langwatch report command includes local scrubbing for PII and secrets, there is no evidence of sanitization for traces being read and interpreted by the agent during the search and discovery phase.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx --yes langwatch report to send bug reports to the vendor.
Details: This command downloads and executes the latest version of the langwatch package from the NPM registry. As this is a tool provided by the skill's official vendor and requires explicit user approval before execution, it is considered a legitimate functionality.
[COMMAND_EXECUTION]: The skill frequently executes langwatch CLI commands to perform its primary functions.
Evidence: Commands like langwatch trace search, langwatch query reference, and langwatch ui call are used extensively throughout SKILL.md.
Mitigation: The skill follows best practices by recommending the use of file-based payloads (--payload-file filter.json) for complex filters to avoid shell injection and splitting issues.

find-traces