The Agent Skills Directory

[Indirect Prompt Injection] (HIGH): The skill possesses a high-severity attack surface for Indirect Prompt Injection because it ingests untrusted data and uses it to influence downstream execution and logic generation.\n
Ingestion points: The debug_llm_output and generate_test_cases functions ingest failed_input and failed_output. The failed_output is typically generated by an LLM and may contain attacker-controlled instructions or malicious payloads designed to subvert the debugging process.\n
Boundary markers: Absent. There are no delimiters (e.g., XML tags or triple quotes with clear instructions) to separate the untrusted data from the debugger's logic or to warn the agent to ignore instructions embedded within that data.\n
Capability inventory: The skill has the capability to execute new LLM requests (llm(fixed_prompt)) and generate functional test cases (using lambda validation logic). If the fixed_prompt or test case logic is poisoned, the agent will execute the attacker's instructions.\n
Sanitization: No sanitization, escaping, or validation is performed on the failed_output before it is processed by the diagnosis logic or interpolated into new prompts.

llm-debugger