The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes a system architecture where an AI agent processes incoming messages from an external database, which represents a surface for indirect prompt injection.\n
Ingestion points: Untrusted data enters the agent's execution environment via the inbound.db file (table messages_in) located at data/v2-sessions/<group>/<session>/ as described in SKILL.md.\n
Boundary markers: According to SKILL.md, the system uses allowedTools and disallowedTools lists within the provider SDK configuration to scope the agent's capabilities.\n
Capability inventory: SKILL.md documents several powerful capabilities available to the system, including Docker container execution, process management via systemctl, and file deletion via rm -rf for clearing sessions.\n
Sanitization: The documentation does not specify any sanitization or validation logic applied to the incoming message content before it reaches the agent provider.\n- [COMMAND_EXECUTION]: The skill provides several bash commands for diagnosing system state and managing services. These include using ps to check for duplicate process instances, systemctl for service lifecycle management, and docker for container inspection. These commands are documented for the user's manual use during debugging and are appropriate for the skill's primary purpose.

debug