The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an inherent attack surface for indirect prompt injection because its core function involves processing and analyzing potentially untrusted external data such as logs and source code.
Ingestion points: The skill ingests external data through tools like analyse_dag_latest_run, get_dag_run_detail, get_dag_source_code, and go_to_dag_log_view (SKILL.md).
Boundary markers: The instructions do not specify any delimiters or safety prompts to ensure the agent ignores embedded instructions within the logs or source code it analyzes.
Capability inventory: The skill includes the trigger_dag_run tool, which gives the agent a write-level capability that could be targeted by a malicious payload in the analyzed content (SKILL.md).
Sanitization: There is no evidence of pre-processing, sanitization, or validation of the external content before it is processed by the agent's logic.

debugging-dags