The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes local repository manifest files (such as package.json, go.mod, and requirements.txt) to identify components and propose a project map. This information is used to generate a traceway-setup-plan.json file, which is then processed by a shell script to automate environment configuration. Malicious content within these analyzed repository files could influence the generated plan, potentially affecting the automated shell script's behavior.
Ingestion points: Reads local configuration files (e.g., package.json, go.mod, composer.json, requirements.txt, pyproject.toml, Package.swift).
Boundary markers: No explicit delimiters or ignore-instructions are used during the manifest file reading phase.
Capability inventory: Shell execution (curl, jq, sh), file writing (.env files, shell scripts), and credential handling.
Sanitization: Uses jq for structured data handling, but variables extracted from the plan are interpolated into shell commands in the generated wait script.
[EXTERNAL_DOWNLOADS]: Fetches and executes an installation script for the Traceway OTel Agent from the vendor's official domain (install.tracewayapp.com). This is part of the standard setup process for host metrics collection and is a legitimate vendor resource.
[COMMAND_EXECUTION]: The skill generates and executes a temporary shell script (traceway-setup-wait.sh) to poll the Traceway API for project approval and automatically update local .env files with project tokens. It also utilizes standard tools like curl and jq for API interaction and data processing.

traceway-setup