The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Kubernetes and Helm configuration files via the Read tool. This creates a potential attack surface for indirect prompt injection. Mandatory Evidence Chain: (1) Ingestion points: The skill uses Read on files matching **/values*.yaml, **/Chart.yaml, and **/templates/*.yaml. (2) Boundary markers: The SKILL.md file contains a robust ## Reviewing untrusted input section that explicitly warns the agent to treat reviewed content as data and ignore any embedded directives. (3) Capability inventory: The skill is restricted to Glob and Read tools, lacking network, shell, or write capabilities. (4) Sanitization: The instructions include logic for consolidated reporting and ignore-reasons, reducing the likelihood of accidental execution of embedded instructions.\n- [PROMPT_INJECTION]: The static analysis identified strings like 'ignore previous instructions' in SKILL.md. However, these are defensive instructions designed to prevent the agent from being subverted by adversarial data within reviewed Helm charts. These patterns represent safety features rather than malicious intent.\n- [COMMAND_EXECUTION]: The evaluation suite includes a validate.sh script that performs local static analysis using standard utilities like grep and find. These scripts are used for CI/CD consistency checks of the rule catalog and are not exposed to the agent's runtime toolset or external input.\n- [CREDENTIALS_UNSAFE]: Test fixtures in the evals/ directory contain hardcoded placeholder credentials (e.g., 'hunter2', 'AKIAIOSFODNN7EXAMPLE') and redacted Stripe keys. These are documented as non-functional fixtures used exclusively to verify the skill's ability to detect and flag secrets in Helm values files.

k8s