The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and local files that could contain malicious instructions designed to subvert the agent's troubleshooting logic.
Ingestion points: External content retrieved through the WebSearch and WebFetch tools, as well as project-specific patterns loaded from learnings.yaml (SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when the agent interpolates external content into its diagnostic reasoning.
Capability inventory: The skill utilizes file system tools (Read, Glob, Grep) and network capabilities (WebFetch) which could be misdirected by injected instructions.
Sanitization: No explicit content validation or sanitization requirements are mentioned for data retrieved from web searches or external URLs.
[DATA_EXFILTRATION]: The skill's persistence mechanism relies on environment variables for file paths, creating a potential vector for unauthorized data writes.
Evidence: Step 5 in SKILL.md instructs the agent to write thinking artifacts to a directory path provided via an environment variable. While this is a common state-management pattern, the lack of path validation or sandboxing could allow an attacker who controls the environment variable to direct the agent to overwrite sensitive files or write data to public-facing directories.

troubleshoot