The Agent Skills Directory

[COMMAND_EXECUTION]: The skill presents a surface for indirect injection when validating user-provided tokens in Step 1.
Ingestion points: User-supplied API tokens and credentials provided during the validation workflow.
Boundary markers: Absent; token values are interpolated directly into Python command strings (python3 -c "token = 'TOKEN_VALUE'...").
Capability inventory: Uses the Bash tool and python3 -c to execute dynamic code blocks.
Sanitization: Absent; there is no evidence of escaping or input validation to prevent a crafted token from breaking out of the string literal and executing arbitrary code.
[DATA_EXFILTRATION]: Instructions provide patterns for retrieving secrets in plain text using the --plain flag and exporting them to environment variables. While functional for secret management, this facilitates the exposure of raw sensitive credentials in command history or logs.
[COMMAND_EXECUTION]: Integration patterns for the mise tool utilize the exec() function within .mise.toml to dynamically execute Doppler CLI commands, which runs shell commands to fetch environment variables at runtime.
[EXTERNAL_DOWNLOADS]: The skill references and provides installation commands for the Doppler CLI from the official DopplerHQ Homebrew tap, which is a well-known and recognized service for secret management.

doppler-secret-validation