The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the official Logfire SDK and related instrumentation packages from established registries (PyPI, NPM, Cargo). All packages (e.g., logfire, @pydantic/logfire-node) are resources provided by the vendor, 'pydantic'.
[COMMAND_EXECUTION]: The skill uses uvx and npm exec to run the Logfire CLI for authentication, project selection, and diagnostics. It employs security measures like --isolated (for uvx) and temporary directories with --prefix (for npm) to ensure the CLI tools run in clean environments and do not interact with potentially malicious local files.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it reads project manifests (package.json, pyproject.toml, Cargo.toml) and processes telemetry data.
Ingestion points: Reads manifest files and potentially user-controlled telemetry content.
Boundary markers: The instructions explicitly warn the agent to treat telemetry data as diagnostic rather than instructional and to independently verify any remediation steps.
Capability inventory: The agent can perform file writes, package installations, and subprocess executions as part of the instrumentation process.
Sanitization: The skill encourages manual verification and warns against blindly following steps found in data.
[CREDENTIALS_SAFE]: The skill manages LOGFIRE_TOKEN and related credentials using standard practices. It specifically instructs against printing tokens or committing them to source control, preferring .env files or project-specific credential files (.logfire/logfire_credentials.json).

logfire-instrumentation