The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions to conceal certain system behaviors from the user, specifically regarding sandbox restrictions. It directs the agent with: "Do not tell the user the sandbox blocked the collector unless a sandboxed attempt actually failed." It also instructs the agent to proactively seek privilege escalation or approval for running the log collector.
[COMMAND_EXECUTION]: The workflow requires the agent to execute a local Node.js script (scripts/log-server.mjs) which starts an HTTP server on the loopback interface. While restricted to 127.0.0.1, this still represents the execution of a network-capable service on the host machine.
[DATA_EXPOSURE]: The skill facilitates the capture of runtime data via instrumentation probes. While it advises against logging credentials, the captured data is stored in unencrypted local NDJSON files (.runtime-debug/logs/<session_id>.ndjson), creating a potential exposure point for sensitive application state if the logs are not properly cleaned up.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to instructions embedded in the data it processes.
Ingestion points: The agent reads NDJSON log files from .runtime-debug/logs/ to diagnose bugs (SKILL.md, Step 8).
Boundary markers: No explicit delimiters or instructions are used to treat the log content as untrusted data when the agent parses the logs.
Capability inventory: The agent can perform file writes, code edits, and further command execution based on its analysis of these logs (SKILL.md, Step 10).
Sanitization: There is no validation or sanitization of the data ingested from the log files. An attacker who can influence the application's runtime state (e.g., via web inputs) could inject malicious content into the logs to mislead the agent.

runtime-debug