The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection because it ingests and processes untrusted production error data to diagnose and repair code.
Ingestion points: Production error data is pulled from the sentinel table and functional stacks/inputs are retrieved via MCP (Workflow Steps 3 and 4).
Boundary markers: The skill mentions that errors are "redacted at write time" (Step 2), providing some protection, but it lacks explicit instructional delimiters to prevent the agent from following commands embedded within the error logs themselves.
Capability inventory: The agent can write to git branches, open PRs, and execute commands including tsc, migrate-rehearse, and reproduction test cases (Steps 5, 6, and 7).
Sanitization: While "redaction at write time" is mentioned, there is no explicit validation or sanitization of the logic generated by the LLM before it is executed in the rehearsal phase.
[COMMAND_EXECUTION]: The workflow relies on executing shell-level commands and platform tools to certify code fixes.
Evidence: The skill executes tsc --noEmit and migrate-rehearse to validate the proposed changes (Workflow Step 6).
[DYNAMIC_EXECUTION]: The skill generates code patches based on error analysis and subsequently executes them in a preview environment.
Evidence: Step 6(c) involves a "reproduce-then-confirm-gone" phase where the triggering input is replayed against the newly generated/fixed code to assert success.
[DATA_EXFILTRATION]: The skill interacts with production data environments and snapshots, which poses a risk of exposure if the agent is compromised.
Evidence: The certification process involves running migrations (migrate-rehearse) on previews seeded with "prod snapshots" (Step 6b).

convex-self-heal