The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from multiple sources, including bug reports, application logs, and PR comments.
Ingestion points: Data enters the agent's context through bug reports (SKILL.md Step 0.1), log queries, metric snapshots, and traces (SKILL.md Step 0.4 and LAYERS.md).
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded commands within the processed data, increasing the risk that malicious instructions in logs could be followed.
Capability inventory: The agent is authorized to generate and execute throwaway scripts (SKILL.md Step 0.4), interact with Kubernetes (kubectl), execute system-level debugging tools like tcpdump and strace (LAYERS.md), and modify code (SKILL.md Step 4).
Sanitization: While the skill mandates the redaction of secrets, it does not specify sanitization or validation of the content of logs or reports to prevent instruction injection.
[DYNAMIC_EXECUTION]: The skill explicitly instructs the agent to create and run custom scripts.
Evidence: Step 0.4 in SKILL.md directs the agent: "When no tool reaches a fact, write a throwaway script to gather or count it". This allows for the runtime generation and execution of code based on the agent's current understanding of the debugging task.
[COMMAND_EXECUTION]: The skill utilizes a wide array of powerful system and infrastructure management tools.
Evidence: LAYERS.md lists tools such as kubectl, tcpdump, strace, lsof, and py-spy. Misuse of these tools, potentially triggered by indirect injection, could lead to unauthorized system observation or disruption, though the skill includes "Guardrails" to mitigate destructive actions.

debugging-by-constraints