The Agent Skills Directory

Indirect Prompt Injection Surface: The skill functions by reading workflow definitions and execution traces from external environments. This creates an attack surface where instructions embedded in processed data (like error messages or workflow steps) could potentially influence the agent's logic or behavior.
Ingestion points: Workflow definitions and run history are ingested via tools such as get_flow, get_run_history, and get_run_actions (SKILL.md).
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the workflow data mentioned in the instructions.
Capability inventory: The skill possesses significant capabilities, including modifying workflows (update_flow, edit_flow) and executing shell commands (Bash).
Sanitization: The instructions do not specify sanitization or validation routines for the content retrieved from external workflow runs.
Broad Capability Scope: The skill utilizes a large set of environment management and workflow modification tools. While these permissions are necessary for the skill's diagnostic and remediation purpose, they represent a broad capability set that should be monitored, especially when processing data from external or multi-user environments.

debug-flow