The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources, which creates a surface for indirect prompt injection.
Ingestion points: The skill accepts a raw <input> (bug reports, stack traces, failing test output) in SKILL.md and investigation requests containing a symptom field.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to treat the ingested symptom data as untrusted when forming commands.
Capability inventory: The skill possesses significant capabilities, including executing shell commands via the repro-rerun script, writing files to the .cheese/ directory, and potentially accessing external resources via the /briesearch tool.
Sanitization: There are no instructions for sanitizing or validating the input before it is interpolated into shell commands or hypothesis predictions.
[COMMAND_EXECUTION]: The skill's core functionality relies on executing arbitrary shell commands to build feedback loops and reproduce failures.
Evidence: Phase 2 in SKILL.md explicitly instructs the agent to run the repro-rerun command with a user-defined or agent-derived --cmd. While this is the primary purpose of a debugging skill, it provides a mechanism for executing arbitrary code based on the content of a bug report.

pasteurize