The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions in Step 3 to enable remote JVM debugging via the JDWP agent on port 5005. This configuration allows remote debugger attachment, which is a potential security risk if the application port is exposed to an untrusted network.
[EXTERNAL_DOWNLOADS]: The skill uses curl in Step 5 to fetch log data from the Guidewire Cloud API (your-tenant.cloud.guidewire.com). This is a routine operation for the skill's purpose and targets a well-known enterprise service domain.
[DATA_EXFILTRATION]: The tracing logic in Gosu (Step 2) and TypeScript (Step 4) logs entity states and API request/response bodies. While Step 4 specifically includes logic to mask headers containing 'auth', there is an inherent risk of logging PII or other sensitive application data depending on the content of the entities and API payloads.
[PROMPT_INJECTION]: The skill processes and logs external data from API responses and log files, representing an indirect prompt injection surface.
Ingestion points: API response bodies in Axios interceptors and log entries downloaded via curl.
Boundary markers: No explicit instruction delimiters or 'ignore' warnings are implemented in the provided code snippets.
Capability inventory: The skill has access to Bash, Write, and Edit tools which could be targeted by instructions embedded in the processed data.
Sanitization: Includes logic to mask headers containing 'auth' in integration logs, but does not provide general sanitization or validation for the content of log messages or API bodies.

guidewire-debug-bundle