The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing a third-party Python package gateguard-ai via pip. This installation is not pinned to a specific version, which poses a supply chain risk as updates to the package are not verified by the skill.
[COMMAND_EXECUTION]: The skill's logic explicitly monitors and interacts with high-risk destructive bash commands including rm -rf, git reset --hard, git push --force, and SQL drop table. While the skill intends to gate these commands for safety, it confirms the agent's capability and intention to interact with these system-level operations.
[PROMPT_INJECTION]: The skill utilizes 'Three-stage gate' logic (DENY, FORCE, ALLOW) designed to override the agent's default behavior of immediate tool execution. While this is the intended functionality of the skill, it represents a systematic override of standard agent operational procedures.
[INDIRECT_PROMPT_INJECTION]: The gate prompts interpolate untrusted data, creating a potential surface for indirect injection attacks.
Ingestion points: The skill interpolates file paths ({file_path}), file content (for imports and schemas), and verbatim user instructions into its logic gates in SKILL.md.
Boundary markers: The prompt templates do not utilize specific delimiters or clear instructions for the agent to distinguish between its own logic and potentially malicious content within the interpolated data.
Capability inventory: The skill is designed to control and utilize high-privilege tools such as bash (grep, find, rm, git), Edit, MultiEdit, and Write across the project filesystem.
Sanitization: While the instructions suggest using 'redacted or synthetic values' when investigating data schemas, there is no automated sanitization or escaping applied to strings like file paths or user instructions before interpolation.

gateguard