The Agent Skills Directory

[DATA_EXFILTRATION]: The skill recommends logging sensitive business context and PII, including user.email, user.id, and lifetime_value_cents (as seen in rules/context.md and rules/wide-events.md). Users adopting these patterns should ensure their logging backend and storage are appropriately secured and compliant with privacy regulations.
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns that ingest untrusted data from request bodies and headers (e.g., c.req.json(), user-agent, x-request-id) and incorporates them directly into logs. This creates a potential surface for indirect injection if these logs are later processed by automated agents or LLMs without sanitization.
Ingestion points: c.req.json(), c.req.header('user-agent') in rules/structure.md and rules/wide-events.md.
Boundary markers: None specified in the logging middleware examples.
Capability inventory: External output via logger.info in rules/structure.md.
Sanitization: No sanitization or escaping of external content is implemented in the provided examples.
[METADATA_POISONING]: The author field in the SKILL.md frontmatter is set to boristane, which is inconsistent with the provided vendor context neondatabase. This likely indicates the skill is based on the work of the referenced observability author but reflects a metadata mismatch.

logging-best-practices