The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript files (JSONL or markdown) which creates an attack surface where adversarial instructions in the data could influence the agent's diagnostic logic.\n
Ingestion points: SKILL.md (Workflow steps 2-3), references/session-discovery.md, and prompts/analyst-common.md subagent instructions.\n
Boundary markers: references/context-safety.md mandates usage of awk, sed, and wc to read small, bounded segments of transcript files to prevent context overflow or massive injection payloads.\n
Capability inventory: The skill executes shell commands (gh, curl, zip, tar, awk, sed, grep, wc) and writes results to a local workspace (~/.superpowers/).\n
Sanitization: Implements a mandatory, multi-stage scrubbing process (prompts/scrub.md, prompts/scrub-audit.md) based on a comprehensive redaction policy (references/redaction-policy.md) to remove secrets and PII before any data is exported.\n- [COMMAND_EXECUTION]: The skill utilizes standard shell utilities for processing large transcript files and creating archives.\n
Evidence: references/context-safety.md uses awk, grep, sed, and wc. SKILL.md utilizes zip -r and tar -czf for bundle creation, gated by user approval.\n- [DATA_EXFILTRATION]: The skill interacts with the GitHub API to search for and file bug reports in the obra/superpowers repository.\n
Evidence: references/github-issues.md provides commands for gh search issues and curl requests to api.github.com. These features are designed for official bug reporting and require explicit user approval for each action.

diagnosing-superpowers