The Agent Skills Directory

[PROMPT_INJECTION]: The skill's instructions in SKILL.md contain the phrase "ignore previous instructions" within a context that warns the agent to be cautious of such content in external files. This is a defensive instruction rather than a malicious injection.
[INDIRECT_PROMPT_INJECTION]: The skill auditing process involves reading untrusted Kubernetes manifests, creating a potential surface for indirect prompt injection. 1. Ingestion points: Argo CD and Flux YAML manifests are read using the Glob and Read tools as defined in SKILL.md. 2. Boundary markers: The SKILL.md provides a "Reviewing untrusted input" section advising the agent to treat input as data and ignore embedded commands. 3. Capability inventory: The skill is restricted to Read and Glob tools, minimizing potential impact. 4. Sanitization: Instructions explicitly tell the agent not to allow reviewed content to influence its logic or role.
[CREDENTIALS_UNSAFE]: A hardcoded dummy database connection string was identified in a test fixture. Evidence: evals/cases/bad-gitops-shared-env-plain-secret/deploy/base/secret.yaml contains a DATABASE_URL with a dummy password. This file is part of the skill's evaluation suite and does not pose a security risk to production environments.

gitops