The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, such as error logs, stack traces, and observability data, creating a vulnerability surface for indirect prompt injection.
Ingestion points: External data is ingested via the $ARGUMENTS parameter in SKILL.md and the debugging prompts in resources/implementation-playbook.md that request analysis of logs and traces.
Boundary markers: The instructions lack clear delimiters or safety warnings to prevent the AI from following instructions that might be embedded within the logs or traces being analyzed.
Capability inventory: The workflow orchestrates agents capable of modifying source code, optimizing databases, and executing shell commands, which increases the potential impact of a successful injection.
Sanitization: There are no documented procedures for sanitizing or filtering the ingested data before it is processed by the AI agents.
[DYNAMIC_EXECUTION]: The workflow includes automated execution of scripts within the local environment.
Evidence: The playbook in resources/implementation-playbook.md suggests using git bisect run ./test_reproduction.sh to automate regression testing. This involves the automatic execution of a shell script that may be part of the codebase under investigation, posing a risk if the script's content is untrusted or modified by the agent based on malicious input.

incident-response-smart-fix