The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a potential attack surface for indirect prompt injection if an attacker can control the content of alerts, Slack messages, or tickets the agent reads.
Ingestion points: Slack communication threads, alert/incident references, Linear tickets, and GitHub pull requests or deployment logs.
Boundary markers: The instructions do not define specific delimiters for external content, but they include strong behavioral constraints, such as remaining read-only by default and requiring explicit human authorization for any state changes.
Capability inventory: The agent uses Slack for messaging and executes CLI tools including gh (GitHub), lin (Linear), and various agent-* commands for investigation and reporting.
Sanitization: No explicit sanitization or filtering of external input is mentioned in the instructions.
[COMMAND_EXECUTION]: The skill instructs the agent to use host-approved external shells to execute commands like gh, lin, and agent-*. While these are standard tools for the task, they represent a capability to interact with the host environment and external APIs. The skill attempts to mitigate risk by explicitly instructing the agent to never read, print, or ask for credentials and to stay within a sandboxed environment where possible.

firestop