The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes entire project directories containing untrusted content as input for multiple sub-agents. A malicious file within the source project could contain instructions designed to trick the forking or sanitizing agents into preserving credentials or injecting malicious code into the final public package.
Ingestion points: The skill reads all files from the user-specified project directory (SOURCE_PATH).
Boundary markers: Absent. The prompts for the sub-agents do not include delimiters or instructions to treat the analyzed content strictly as data, leaving the agents vulnerable to instructions embedded in code comments or documentation.
Capability inventory: The agent has full read/write access to the staging directory and the ability to publish to the public internet via the GitHub CLI.
Sanitization: The skill relies on the 'opensource-sanitizer' agent to detect threats, which is itself an LLM-based process subject to the same injection risks.
[DATA_EXFILTRATION]: The skill's primary function involves moving private data to a public GitHub repository using gh repo create --public --push. While this is the intended purpose, it facilitates the exfiltration of sensitive information (secrets, PII, or internal logic) to the public domain if the sanitization agent fails or is subverted.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage the local environment and interact with GitHub, including mkdir, ls, cat, and the gh CLI for repository management and pushing code.
[DYNAMIC_EXECUTION]: The packager agent is tasked with generating a setup.sh executable script. This introduces a risk where malicious instructions in the source project could influence the agent to generate a script that performs unauthorized actions when later executed by a developer.

opensource-pipeline