The Agent Skills Directory

[DATA_EXFILTRATION]: The tool records detailed execution snapshots to the local filesystem in the '.agent-tracing/' directory. These snapshots contain sensitive information including system roles, user memory, knowledge base content, and full LLM conversation histories. While this involves accessing and storing sensitive data, it is the primary intended function of the tracing tool for development and debugging purposes.
[EXTERNAL_DOWNLOADS]: The CLI tool supports downloading remote execution snapshots from object storage buckets (e.g., via S3) as configured by the 'TRACING_BASE_URL' environment variable. This allows developers to inspect production or staging traces locally.
[INDIRECT_PROMPT_INJECTION]: The tool processes execution traces which contain untrusted LLM outputs and user inputs from previous interactions, creating a surface for indirect prompt injection. The 'replay' functionality specifically re-submits these potentially tainted payloads to external LLM providers. 1. Ingestion points: Local JSON snapshots in '.agent-tracing/' and remote snapshots from configured storage URLs. 2. Boundary markers: Not explicitly described in the trace format. 3. Capability inventory: Filesystem access to read/write snapshots and network access to download traces and re-issue LLM calls. 4. Sanitization: No sanitization is mentioned for trace content displayed in the CLI or re-executed during replay.

agent-tracing