The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/terraform_scaffolder.py utilizes subprocess.run to execute local terraform or tofu commands for validating generated infrastructure code. While this is a legitimate operational requirement, the script lacks sanitization of the module_name argument used in directory construction, creating a theoretical path traversal surface.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface through its automated stack detection logic. Ingestion points: scripts/detect_repo_stack.py reads and analyzes various project files (e.g., package.json, requirements.txt, CI configurations) within the target repository. Boundary markers: No explicit delimiters or warnings are used to separate ingested file content from agent instructions. Capability inventory: The skill allows the agent to execute powerful cloud CLI commands (AWS, Azure, GCP) and scaffold deployment pipelines. Sanitization: File content is processed using regex patterns and standard formats (JSON, TOML) rather than direct prompt interpolation. The risk is significantly mitigated by the skill's mandatory requirement for explicit user approval before any cloud mutations are executed.

cloud-management