The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill uses the $ARGUMENTS variable to ingest issue reports and reproduction steps directly into the prompt context in SKILL.md.
Ingestion points: User-provided data enters the context via $ARGUMENTS at the lines 'Process issue from: $ARGUMENTS' and 'Issue to debug: $ARGUMENTS'.
Boundary markers: The instructions do not define boundary markers (e.g., XML tags or triple-backticks) to isolate user input from agent instructions.
Capability inventory: The skill encourages the agent to use tools for sensitive data access (Sentry, DataDog, logs), code modification, and production environment changes (traffic shifting).
Sanitization: There are no instructions to sanitize or escape the input content, making the skill susceptible to malicious instructions embedded within bug reports or log files.
[DATA_EXFILTRATION]: The skill's primary purpose involves gathering sensitive telemetry, error traces, and logs from well-known services like Sentry, DataDog, Splunk, and New Relic. While these are intended features for debugging, this capability creates a data exposure surface that could be abused if the agent is compromised by indirect prompt injection.
[PRIVILEGE_ESCALATION]: The workflow includes high-privilege operations such as dynamic instrumentation of production code and gradual traffic shifting. Although the instructions include warnings to confirm authorization, the presence of these capabilities in a skill that processes untrusted data increases the risk of unauthorized production changes.

debugging-toolkit-smart-debug