The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources, which could contain malicious instructions.
Ingestion points: Fetches project, service, branch, and workflow names from GitHub, Neon, Vercel, and Railway APIs.
Boundary markers: The skill includes a dedicated 'Security' section instructing the agent to treat fetched content as untrusted and render it as plain strings.
Capability inventory: Perform network API calls via secretcurl, executes gh CLI commands, writes to local state/log files, and can create GitHub Pull Requests or delete resources when the 'arm' flag is present.
Sanitization: The author explicitly notes that the agent should never follow instructions embedded in fetched metadata.
[COMMAND_EXECUTION]: The skill uses shell-based logic to process the input variable and execute commands via gh api and a local ./secretcurl utility.
Evidence: Uses bash case statements and sed to parse the scope and arming status from the ${var} parameter before invoking external tools.
Authorization: Destructive actions (deletions) and mutations (PR creation) are strictly gated behind an arm: prefix requirement.

spend-watch