The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data, specifically pull request diffs and source code files, to identify telemetry requirements. This creates a surface for indirect prompt injection where malicious instructions could be embedded in code comments or diff content. However, the skill uses structured checklists and rule-based workflows to process this data, which is inherent to its primary function as a code analysis tool.
[EXTERNAL_DOWNLOADS]: The skill references a GitHub repository for the Dash0 agent-skills project as an optional source for specialized instrumentation capabilities. This reference is documented neutrally and points to a well-known service provider in the observability domain, representing a standard informational reference rather than a risky external dependency.
[COMMAND_EXECUTION]: The skill utilizes the platform's native Skill() invocation syntax to delegate tasks to other components, such as rum-tracking for frontend analytics and persistent-memory for configuration storage. These calls are restricted to specific, non-shell operations within the agent's controlled environment and do not allow for arbitrary command execution.
[SAFE]: The skill maintains an 'Observability Profile' to store project-level facts about the telemetry stack and package maps. This profile is stored in the repository's local file system (typically under memory/observability-profile/) using a committed tier for team visibility. The data recorded is project configuration and does not include sensitive credentials, system keys, or unauthorized data access.

measurable