The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it is designed to ingest and analyze untrusted data.
Ingestion points: In Phase 1 (Evidence Gathering) and Phase 4 (Probes), the skill collects raw stack traces, system logs, git history, and the results of arbitrary shell commands, which are then written to an evidence.md file.
Boundary markers: The prompt templates (e.g., hypothesis.user.md, judge-pass1.user.md) interpolate this evidence data directly into the agent's context without using protective delimiters or 'ignore embedded instructions' warnings.
Capability inventory: The workflow spawns subagents with high-privilege capabilities, including the ability to edit files and execute shell commands (e.g., the fix-worker in workflow.py uses tools_needed=True).
Sanitization: The skill explicitly avoids sanitizing or summarizing external data, recording raw output verbatim in the evidence logs.

deep-debug