The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructions direct the agent to access and analyze sensitive files that may contain credentials or secrets.
Evidence: In references/investigation-protocol.md, the agent is explicitly instructed to examine .env files and "secret rotations" to correlate changes with incidents. Accessing .env files is a high-risk operation as they typically contain API keys, database credentials, and other secrets.
Evidence: The references/diagnostic-commands.md file provides templates for executing commands against production databases (psql, mysql, redis-cli), which facilitates the inspection of system state that may include sensitive information.
[COMMAND_EXECUTION]: The skill relies heavily on executing shell commands to gather diagnostic information from the host environment.
Evidence: references/diagnostic-commands.md contains a wide array of shell scripts for log analysis (grep, awk, find), resource monitoring (top, df, lsof, ss), and infrastructure management (kubectl). These commands provide the agent with deep visibility and control over the local system.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection attacks by ingesting and processing untrusted data to generate outputs.
Ingestion points: The agent reads application logs, container logs, and deployment artifacts, all of which could contain malicious payloads designed to influence agent behavior (found in references/investigation-protocol.md).
Boundary markers: The skill does not provide instructions for using delimiters or protective wrappers around ingested content to differentiate between data and instructions.
Capability inventory: The skill is configured with Bash, Write, Edit, WebFetch, and WebSearch tools, enabling it to perform impactful actions based on processed inputs.
Sanitization: No sanitization or validation mechanisms are specified for handling untrusted data before it is interpolated into incident reports (incident-report.md) or external communications.

incident-responder