The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external systems which can be manipulated to influence agent behavior.
Ingestion points: The skill reads latest_error strings and schema metadata from external sources (e.g., Stripe, Postgres, HubSpot) using tools like external-data-sources-list and external-data-schemas-retrieve.
Boundary markers: The instructions do not provide delimiters or instructions for the agent to treat latest_error content as untrusted text, which could lead to the agent following instructions embedded in error messages.
Capability inventory: The skill has access to destructive tools including external-data-schemas-resync (data wiping), external-data-schemas-delete-data, and external-data-sources-partial-update (credential updates).
Sanitization: There is no evidence of sanitization or strict schema validation for the external error strings before they are processed by the agent.
[CREDENTIALS_UNSAFE]: The skill facilitates a troubleshooting workflow where the agent is instructed to collect raw credentials (e.g., stripe_secret_key, signing_secret) directly from the user in the chat and pass them to the external-data-sources-partial-update tool. This pattern of handling secrets in cleartext within a chat session poses a risk of credential exposure in logs or session histories.

diagnosing-failed-warehouse-syncs