The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that direct the agent to bypass standard user confirmation protocols during its operation. Specifically, the 'Consultant Mode' section states, 'Do NOT ask permission before Phase 1 and 2. Deliver value first.', which instructs the agent to perform extensive file reading and content generation tasks autonomously.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes data from external documentation and the local project environment without adequate safety boundaries.
Ingestion points: External documentation URLs (e.g., https://langwatch.ai/docs/llms.txt), CLI-based documentation (langwatch docs), and the local codebase (source files, READMEs, git logs).
Boundary markers: No delimiters or safety instructions are provided to prevent the agent from executing commands potentially hidden within these sources.
Capability inventory: Access to shell execution, package managers (pip, npm), file system operations, and network reporting tools.
Sanitization: No sanitization is performed on the ingested documentation or code content.
[DATA_EXFILTRATION]: The skill utilizes langwatch report to transmit session transcripts and metadata to LangWatch's external servers for debugging. While the command includes a flag for user approval and mentions local PII scrubbing, it establishes an outbound data transfer path.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of several external software packages, including langwatch and langwatch-scenario, from public package registries.
[REMOTE_CODE_EXECUTION]: The skill instructs the use of npx to execute remote packages from the npm registry (e.g., tsx, vitest, langwatch report). The use of the --yes flag in these commands automatically accepts the installation and execution of the remote code without further user prompts.

level-up