The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as jq, node, head, and gunzip to process user-provided files. This occurs in SKILL.md and rules/input-detection.md to identify and analyze profile formats.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data from React and Chrome profiles. Maliciously crafted profiles could contain instructions in fields like displayName, functionName, or url (as described in rules/react-profile-analysis.md and rules/chrome-trace-analysis.md) that attempt to influence the agent's behavior during the summary or reporting phase.
Ingestion points: rules/input-detection.md, rules/react-profile-analysis.md, rules/chrome-trace-analysis.md, and the scripts scripts/heap-summary.mjs and scripts/heap-diff.mjs all read data from external files into the agent's context.
Boundary markers: No specific delimiters or warnings to ignore instructions within the profile data are used when extracting strings for the report.
Capability inventory: The agent has access to node, jq, and shell utilities, which could be leveraged if an injection is successful.
Sanitization: The skill does not implement sanitization for the extracted profile metadata before including it in the report template.
[DATA_EXFILTRATION]: The local Node.js scripts scripts/heap-summary.mjs and scripts/heap-diff.mjs use fs.readFileSync on file paths provided as command-line arguments. While intended for performance snapshots, if an attacker provides a path to a sensitive file (e.g., ~/.ssh/id_rsa), the script will attempt to parse it as JSON and output parts of the content or errors, potentially exposing the data to the agent's context.

profile-optimizer