The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It processes untrusted data from multiple ingestion points including AGENTS.md, codebase files (via rg and view_file), and external documentation pages (via load_url). There are no explicit boundary markers or delimiters defined to prevent the agent from following instructions embedded within these external sources. The capabilities available to the agent following such ingestion include creating git commits and executing shell commands for validation.
[COMMAND_EXECUTION]: The skill performs shell command execution for two primary purposes: validating code changes (ensuring exit status 0) and performing version control operations via git commit, git log, and git show. While it explicitly prohibits destructive actions like push --force, these commands are driven by implementations derived from potentially untrusted codebase context.
[EXTERNAL_DOWNLOADS]: The skill uses external network operations to fetch documentation. In Step 10 of the Shared prep section, it utilizes the load_url tool within the user-dash-api MCP ladder to retrieve documentation pages. This is a legitimate feature for ensuring API accuracy but represents an external data dependency.
[DYNAMIC_EXECUTION]: The skill employs dynamic tool invocation by instructing the agent to "discover and use the matching observability MCP" based on incident signals and to discover tools on user-dash-api rather than using static tool names. While this is a common pattern for extensible agent platforms, it relies on runtime discovery of executable capabilities.

dev