The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use the local shell environment and common interpreters to manage data volume.
Evidence: SKILL.md contains specific instructions: "Use Bash with python3 or jq to extract the specific slice you need" when tool outputs are too large for the context window.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted external data with high-capability tools.
Ingestion points: Untrusted data is retrieved from external logs, error messages, and session metadata via tools like query-logs and query-error-groups.
Boundary markers: No specific boundary markers or "ignore instructions" delimiters are mandated for the processing of this external data.
Capability inventory: The agent is explicitly authorized to use bash, python3, and jq to process the files containing this untrusted data.
Sanitization: There are no instructions for sanitizing or escaping the data before it is passed to shell commands or interpreters, potentially allowing for command injection if an attacker can control log or error contents.

investigate