The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data (stack traces provided by the user) which is subsequently used as input for multiple LLM-based reasoning steps.
Ingestion points: The user's input message is ingested in the trace_collect and parse_trace steps within SKILL.md.
Boundary markers: The skill uses XML escaping (xml_escape) and textual separators (triple dashes) to delimit the user data within prompts.
Capability inventory: The skill possesses the ability to execute shell commands (exec_command) and save data to persistent memory (memory_save).
Sanitization: The skill employs significant mitigations, including explicit instructions in the repro_suggestion and degraded_summary steps that strictly forbid the LLM from proposing or executing commands that create, overwrite, or edit files (e.g., prohibiting heredocs, redirection, or tee).
[COMMAND_EXECUTION]: The skill utilizes the exec_command tool to perform repository inspections.
Evidence: The commands executed (including rg, gh issue list, and git log) are hardcoded within the SKILL.md file with static arguments, preventing the injection of arbitrary user commands into the shell.
Scope: These operations are limited to read-only information gathering, such as searching for symbols, listing related issues, and reviewing commit history.

meta-stack-trace-investigator