The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to process untrusted data such as application logs, stack traces, and source code, making it vulnerable to Indirect Prompt Injection (Category 8).
Ingestion points: Production logs, crash reports, and source code are read in SKILL.md (Phase 2), references/evidence.md, and the evaluation fixtures in evals/.
Boundary markers: The instructions lack specific guidance for the agent to use delimiters or to treat processed data strictly as non-executable text.
Capability inventory: The skill leverages powerful capabilities including git, ripgrep, kubectl, docker, and database access via MCP servers.
Sanitization: No sanitization or validation of the ingested evidence content is specified.
[DATA_EXFILTRATION]: The skill directs the agent to access sensitive environment and configuration data (Category 2).
Evidence: SKILL.md and references/evidence.md explicitly instruct the agent to "Gather and read: ... configuration and env vars" and "Verify what's actually deployed ... versus what the repo claims." This is necessary for the skill's purpose but involves access to potentially sensitive files like .env or configuration repositories.
[COMMAND_EXECUTION]: The RCA workflow encourages the use of various system tools and command-line interfaces.
Evidence: SKILL.md lists git, ripgrep, kubectl, and docker as primary tools for gathering evidence from the execution environment.
[NO_CODE]: The skill consists entirely of instructional markdown and evaluation data; it does not distribute executable scripts or binaries.

root-cause-analysis