The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from production AI traces, which could contain malicious instructions intended to influence the agent's analysis.
Ingestion points: The tool posthog:query-llm-trace is used to read raw input and output content (e.g., $ai_input, $ai_output) from the posthog.ai_events table as described in references/finding-traces.md.
Boundary markers: The instructions do not specify the use of delimiters or specific 'ignore' instructions when processing the trace content.
Capability inventory: The agent has access to posthog:execute-sql for database queries, posthog:query-llm-trace for reading content, and posthog:generate-app-url for creating deep links.
Sanitization: There is no explicit instruction to sanitize or escape the content retrieved from traces before the agent processes it for categorization.

exploring-ai-failures