The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted external data via the $ARGUMENTS placeholder, which is intended to hold error messages, stack traces, and reproduction steps.
Ingestion points: Untrusted data enters the agent context through the $ARGUMENTS placeholder in SKILL.md, used in both the 'Context' definition and the final task instruction.
Boundary markers: The instructions lack explicit delimiters or safety instructions to prevent the agent from executing instructions that might be embedded within the logs or error reports being analyzed.
Capability inventory: The skill grants the agent the ability to query observability platforms (Sentry, DataDog, etc.), analyze execution paths, and generate code fixes or instrumentation.
Sanitization: No input validation or sanitization mechanisms are described to filter out malicious payloads within the debug data.
Risk: A malicious user or an attacker could supply an error report containing hidden instructions (e.g., in a stack trace or log entry) designed to trick the agent into exfiltrating data through its reporting mechanism or generating backdoored code fixes.

error-diagnostics-smart-debug