The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents the use of dynamic variables such as {{ trigger_comment }} and {{ body }} which ingest untrusted data from Git webhook payloads (PR comments, commit messages, and headers).
Ingestion points: Webhook payloads, pull request comments, and commit messages are ingested via variables in the PipelineRun specification.
Boundary markers: The skill describes the use of CEL (Common Expression Language) for event matching and filtering, which acts as a primary boundary for triggering execution.
Capability inventory: The system creates PipelineRun resources which can execute arbitrary shell commands and containerized tasks within the Kubernetes cluster.
Sanitization: The instructions recommend using YAML block scalars (|-) to handle multi-line content and prevent validation errors, but no explicit sanitization or escaping of the variable content is described to prevent command injection within the executed tasks.
[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install core components and CLI tools from established repositories.
Evidence: Mentions applying release.k8s.yaml from the official tektoncd/pipelines-as-code GitHub releases and installing the CLI via the openshift-pipelines/pipelines-as-code Homebrew tap.
Assessment: These sources are well-known technology organizations and project repositories associated with the documented tool, presenting no immediate risk.
[COMMAND_EXECUTION]: The skill includes instructions for cluster-level operations and local CLI usage.
Evidence: Commands such as kubectl apply, brew install, and tkn pac bootstrap are provided for installation and configuration.
Assessment: These are standard administrative actions required for the operation of the CI/CD controller and CLI, typically executed by a cluster administrator.

tekton-pac