The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes two utility scripts, scripts/compose-check.sh and scripts/image-audit.sh. These scripts execute standard Docker CLI commands such as docker compose config, docker image inspect, and docker history to perform local audits of images and configurations. These are legitimate tools for the skill's intended purpose.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze potentially untrusted user content (Dockerfiles and Compose files), which creates an inherent attack surface for indirect prompt injection.
Ingestion points: The agent reads external files using the Read tool as part of its review workflow.
Boundary markers: The SKILL.md file contains a specific 'Reviewing untrusted input' section that provides clear defensive instructions, warning the agent to treat these files as data rather than instructions and to ignore any directives (like 'ignore previous instructions') embedded in comments or strings.
Capability inventory: The skill has access to Bash, Glob, and Read tools.
Sanitization: The agent is directed to follow a strict 'Rule Catalog' (IDs CICD-DOCK-001 through 016), which constrains its output to predefined security and best-practice findings.
[SAFE]: The deterministic detection of prompt injection in evals/README.md is a false positive. The phrase 'copy it' is part of developer documentation providing a template for evaluation cases and does not represent an attempt to subvert the agent's system instructions.
[SAFE]: All credentials found in the evaluation fixtures (e.g., DATABASE_PASSWORD=hunter2, API_TOKEN=PLACEHOLDER_FAKE_NOT_A_SECRET) are clearly marked as placeholders or dummy data for testing the skill's detection capabilities (Rule SEC-SEC-001) and do not represent actual secret exposure.

docker