The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze user-provided configuration files (.gitlab-ci.yml), which constitutes an attack surface for indirect prompt injection. * Ingestion points: Files matching **/.gitlab-ci.yml and **/gitlab-ci*.yml are read into the agent context using the Read tool as specified in SKILL.md. * Boundary markers: The skill includes a dedicated section ('Reviewing untrusted input') that explicitly instructs the agent to treat reviewed files as data rather than instructions and to ignore attempts to override rules. * Capability inventory: The skill is configured with safety: read-only in the frontmatter and the instructions confirm it does not perform file-write operations. * Sanitization: The skill relies on specific defensive prompts to instruct the agent to identify and report injection attempts in reviewed code.
[CREDENTIALS_UNSAFE]: The repository contains a sample kubeconfig fixture used for evaluation purposes that includes hardcoded credentials. * Evidence: The file evals/cases/bad-ci-shared-job-static-keys/kubeconfig-prod.yaml contains a token field with a base64-encoded string. * Context: This is a dummy token (k8s-hello-world-this-is-a-fake-token-for-a-fixture) used within a negative test case to verify the skill's ability to detect committed secrets in pipelines. This is an expected behavior for a security-focused review skill.

ci