The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute SQL statements against production databases to validate schema changes and permission updates. While this is performed within a transaction block meant to be rolled back (Technique 1), it requires the agent to have direct command execution capabilities on live data stores.
[DATA_EXFILTRATION]: The instructions require the agent to access sensitive configuration data, specifically mentioning the need to 'Read the job definition, including the secret it resolves' to verify credential matching (Technique 2). This involves exposure of secrets to the agent context, though the skill includes explicit safety rules forbidding the copying of this data into scratch files or reports.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests and analyzes data from potentially untrusted external sources, such as system logs and provider-side records.
Ingestion points: The agent is instructed to read transport layer response logs (e.g., HTTP extension response tables, gateway access logs) and provider-side logs from services like mail, payments, or storage (Technique 2 and Technique 5).
Boundary markers: The skill does not define formal delimiters for this external data, relying instead on high-level instructions to report counts rather than raw rows.
Capability inventory: The agent possesses capabilities for database querying, file system access (for reading job definitions and handlers), and log ingestion.
Sanitization: No explicit sanitization or filtering of log content is prescribed before it is processed by the agent, creating a surface for embedded instructions in log messages to influence the agent's summary or analysis.

ground-truth