The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it processes project files to determine instrumentation points.
Ingestion points: In SKILL.md (Step 5), the agent is instructed to select and read 10 to 15 project files that may contain login logic or business-valuable events.
Boundary markers: Absent. There are no instructions to use delimiters or ignore embedded instructions within the project files being analyzed.
Capability inventory: The skill possesses significant capabilities, including installing packages via system package managers (Step 3), writing code to project files (Step 6), and modifying sensitive environment configuration files like .env (Step 9).
Sanitization: No sanitization or validation of the code content being ingested is specified, allowing potential malicious instructions in comments or string literals within the project to influence the agent's behavior.
[DATA_EXFILTRATION]: The skill specifically instructs the agent to extract data from user-facing forms for analytics purposes.
Evidence: SKILL.md (Step 7) directs the agent to "Use the contents of login and signup forms to identify users on submit" and send this data to PostHog via identify() calls. While this is the intended functionality of an analytics tool, it involves the systematic extraction and transmission of potentially sensitive user data to a third-party service.
[COMMAND_EXECUTION]: The skill executes package manager commands to install dependencies.
Evidence: SKILL.md (Step 3) requires the agent to use package manager commands (e.g., npm install, pip install) to add the PostHog SDK. While these targets are well-known and legitimate vendor resources, the capability to execute arbitrary installation commands is a high-privilege operation.

instrument-product-analytics