The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the analysis of external, potentially untrusted infrastructure files.
Ingestion points: Processes Dockerfiles, Terraform scripts, Kubernetes manifests, and CI/CD workflow files (SKILL.md).
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the processing logic.
Capability inventory: Uses shell tools via Bash and has access to network operations via WebFetch (SKILL.md).
Sanitization: No evidence of sanitization or validation of the content within the processed files before reporting findings to the agent context.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill's primary function includes a 'Secrets sweep' designed to locate and report highly sensitive information.
Evidence: Explicitly identifies high-entropy strings, private keys, API tokens, and credentials stored in environment variables or configuration files. While this is the intended defensive behavior, the identification of these secrets in a context with network capabilities poses a residual data exposure risk.
[DYNAMIC_EXECUTION]: The skill executes external security linters and scanners (such as hadolint, tfsec, and checkov) through the shell.
Evidence: It resolves scan scopes using user-provided arguments ($ARGUMENTS) and file paths, which are then passed to shell-based tools via the 'Bash' and 'Task' tools (SKILL.md). This pattern is typical for developer tools but presents a surface for command injection if inputs are not handled safely.

iac-scan