The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Pod logs and metadata, creating a potential surface for indirect prompt injection attacks.
Ingestion points: Untrusted data enters the agent's context through the stream-pod-logs and get-pod tools.
Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" warnings for the log content being processed.
Capability inventory: The skill has access to sensitive capabilities including pod-action, delete-pod, and create-pod which could be targets of injection-driven behavior.
Sanitization: There is no documented logic for sanitizing or filtering log output before the model processes it.
Context: The risk is minimized by the skill's design, which mandates that recovery plans must be presented for user approval rather than executed autonomously.

pod-doctor