The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user via $ARGUMENTS and the symptom gathering process (expected behavior, actual behavior, error messages). This content is interpolated directly into the prompt for the gsd-debugger subagent. While the prompt uses XML-like tags to wrap the symptoms, there is no explicit instruction for the subagent to ignore embedded commands or logic within these fields. A malicious user could provide a 'reproduction' or 'error message' that contains instructions to the agent to perform unauthorized file deletions or exfiltration. Ingestion points: SKILL.md (via $ARGUMENTS) and symptom gathering (Step 2). Boundary markers: Present (XML tags) but incomplete (no instruction-data separation). Capability inventory: The spawned subagent possesses tool access (Bash, Read) which can be manipulated via the injection surface. Sanitization: None performed on the input strings.
[COMMAND_EXECUTION]: The skill executes a local Node.js script located at {{PLATFORM_ROOT}}/get-shit-done/bin/gsd-tools.cjs to load state and resolve model configurations. These are vendor-specific tools associated with the 'shoootyou' (get-shit-done) ecosystem and are used for expected state management functionality.

gsd-debug