The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill guides the agent to query and process runtime logs (e.g., logs/app.json) which aggregate data from external system inputs and HTTP requests. This ingestion of untrusted data into the agent's context allows for potential indirect prompt injection if an attacker can influence log content.
Ingestion points: Agents are instructed to read logs/app.json directly or via the /__dev/logs endpoint as described in Phase 3 and Phase 4.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided to the agent for log consumption.
Capability inventory: The skill enables the agent to use powerful shell tools such as tail, grep, and jq to parse logs, and potentially execute further commands based on log findings.
Sanitization: The documentation suggests redacting PII from logs for data privacy, but lacks measures to prevent the agent from obeying adversarial instructions embedded within log messages.
[DATA_EXFILTRATION]: The skill recommends exposing application logs through a development-only endpoint that explicitly bypasses authentication to ensure the agent can access it without a pre-existing session.
Evidence: The references/dev-endpoint.md file contains implementation patterns for multiple frameworks (e.g., Rails skip_before_action :authenticate_user!) that lower the security posture to facilitate agent integration.
Sensitive Discovery: The audit phase (Phase 1) uses grep commands to identify the location of sensitive configuration files (.env*) and service identifiers (e.g., SENTRY_DSN) to map the observability landscape.

agent-telemetry