The Agent Skills Directory

[Indirect Prompt Injection] (MEDIUM): The skill processes untrusted external content that can influence agent reasoning. Ingestion points: Accesses source code, logs, and error messages using cat, grep, and file: read (SKILL.md, Phase 2). Boundary markers: Absent. No delimiters are used when interpolating file contents into the context. Capability inventory: Uses bash (read-only tools) and file: read. While the skill's own tools are restricted, the instructions (Phase 3) direct the agent to 'Implement the fix', which likely utilizes write capabilities in the broader agent context. Sanitization: Absent. There is no filtering or validation of the ingested content.
[Command Execution] (LOW): The skill requests access to bash for utilities like git, grep, and ls. These tools provide broad visibility into the filesystem, which is necessary for debugging but constitutes a data exposure risk if the environment contains sensitive files.

debug-to-fix