The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to ingest and analyze external Dockerfiles, which can be used as a vector for indirect prompt injection if those files contain malicious instructions disguised as configuration or comments.
Ingestion points: The skill instructions (SKILL.md) prompt the agent to read and scan Dockerfiles using Hadolint (e.g., local development scanning and CI/CD workflows).
Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore instructions embedded within the Dockerfile content during analysis.
Capability inventory: The skill possesses the capability to run shell commands (hadolint, docker) and provides Python and Shell scripts for scanning.
Sanitization: No sanitization or filtering is applied to the Dockerfile content before the agent processes it.
[COMMAND_EXECUTION]: The CI/CD configuration templates provided in the assets directory contain insecure shell scripting patterns that could be exploited via malicious file naming.
Evidence: In assets/github-actions.yml and assets/gitlab-ci.yml, the scripts use find to populate a variable (DOCKERFILES) and then iterate over it using a for loop without proper null-termination or array handling (e.g., for dockerfile in $DOCKERFILES).
Impact: Filenames containing spaces or shell metacharacters could cause the CI pipeline to execute unintended commands or fail to correctly lint security-critical files.
[EXTERNAL_DOWNLOADS]: The skill documentation and automated templates facilitate the download of binary executables from external sources.
Evidence: SKILL.md and assets/github-actions.yml provide commands to download the Hadolint binary: wget -O /usr/local/bin/hadolint https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64.
Evaluation: The downloads target the official GitHub repository of the Hadolint project. As this is a well-known service and the official source for the tool, the references are documented neutrally and follow standard installation procedures.

container-hadolint