The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's diagnostic examples in SKILL.md and root-cause-tracing.md instruct the agent to run commands like security list-keychains and security find-identity -v (on macOS) during Phase 1 (Root Cause Investigation). While intended for debugging signing and credential issues, these commands expose sensitive system-level metadata and identity information to the agent's execution context.
[COMMAND_EXECUTION]: The skill includes a bash script find-polluter.sh which executes npm test on files identified through user-provided patterns. Furthermore, the instructions in SKILL.md provide examples for executing tools such as codesign, git init, and other CLI utilities. This represents a capability surface where the agent performs local command execution to fulfill debugging tasks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze potentially untrusted external data such as error messages and stack traces.
Ingestion points: SKILL.md Phase 1 explicitly directs the agent to "Read Error Messages Carefully" and "Read stack traces completely."
Boundary markers: There are no instructions provided to wrap this external content in delimiters or to use "ignore embedded instructions" warnings.
Capability inventory: The skill has access to shell execution (npm, git, security) and file system operations (ls, find).
Sanitization: The process does not include steps to sanitize or validate the content of error logs or stack traces before they are processed by the agent.
[PROMPT_INJECTION]: The evaluation files test-pressure-1.md, test-pressure-2.md, and test-pressure-3.md utilize forceful language ("IMPORTANT: This is a real scenario", "You must choose and act", "make the actual decision") and role-play ("You're the on-call engineer"). Although these are intended as a testing suite to verify the agent's adherence to the debugging process, the patterns mirror instruction override and jailbreak simulation techniques.

systematic-debugging