The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data that is then used to drive high-capability actions like code modification and local test execution.
Ingestion points: The skill accepts external data through the triệu chứng (symptoms) and log / screenshot / bối cảnh (logs/context) fields as defined in the Input contract in SKILL.md.
Boundary markers: The instructions lack explicit boundary markers or directives for the agent to distinguish between data (logs) and instructions, increasing the risk that instructions hidden in logs could be executed.
Capability inventory: The skill possesses significant capabilities, including the ability to write code via the safe-change tool, execute local tests, and write incident reports to the filesystem (llmwiki/wiki/sources/).
Sanitization: There are no mentioned mechanisms for sanitizing, escaping, or validating the ingested logs or symptom descriptions before they are used to influence the agent's reasoning and code generation steps.

orca-issue