The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The wrapper script scripts/langfuse-cli executes a binary located at a hardcoded absolute path within a specific user's directory: /home/lamrin/.cache/uv/archive-v0/Hj__dDMjU1XU-7V8sJzvv/bin/mcp2cli. Executing code from a specific user's cache directory is highly insecure as the binary's integrity cannot be verified and it relies on an environment that is not managed by the skill's own configuration.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted data from Langfuse, including trace logs, observations, and prompt templates, which can contain instructions targeting the agent.
Ingestion points: External data is ingested through tools like fetch-traces, fetch-observations, and get-prompt (defined in SKILL.md).
Boundary markers: The skill documentation does not mention or implement any delimiters or boundary markers to isolate retrieved data from system instructions.
Capability inventory: The skill has the ability to execute shell commands via the scripts/langfuse-cli wrapper and write to the filesystem (log files).
Sanitization: There is no evidence of sanitization or filtering of the external data before it is interpolated into the agent's context.
[COMMAND_EXECUTION]: The skill's primary interface is a bash script that wraps tool calls, providing a surface for command execution and potential argument manipulation if input is not handled carefully, though the use of "$@" in the exec call is a standard practice.

langfuse-cli