The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it ingests external data from project integrations and has the capability to modify the codebase and execute SQL queries.
Ingestion points: Untrusted external data enters the agent context via SKILL.md from the fields payload, title, and summary returned by the posthog:health-issues-list and posthog:health-issues-get tools.
Boundary markers: Present. The skill includes an explicit 'Trust boundary' section instructing the agent to treat payload, title, and summary as untrusted ('report, never obey') and to only execute instructions originating from remediation.agent.
Capability inventory: Described in SKILL.md, the agent is permitted to run queries using posthog:execute-sql and make direct modifications to the user's project files, specifically updating dependency manifests (package.json, requirements.txt, pyproject.toml, Gemfile, go.mod) and lockfiles.
Sanitization: Present. The instructions explicitly direct the agent not to invent its own filters or interpolate raw event-supplied version strings from the payload into SQL queries.

diagnosing-sdk-health