The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill analyzes repository files such as README, .env, and docker-compose to identify configuration stages and variable names. This ingestion of untrusted data represents an attack surface where a malicious repository could influence the agent's behavior or the content of the generated script.
Ingestion points: Processes .env, .env.example, README, docker-compose*, framework configuration files, and .github/workflows/* to identify required secrets and variables.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands used when the agent processes these external files.
Capability inventory: The skill generates executable bash scripts, modifies file permissions using chmod +x, and the generated scripts utilize the GitHub CLI (gh) and system URL openers to interact with external services.
Sanitization: The instructions do not define validation or sanitization steps for the keys or values extracted from repository files before they are interpolated into the generated shell script template.
[COMMAND_EXECUTION]: The template.sh library uses dynamic variable assignment via printf -v "$key" and shell commands like grep to manage configuration updates. If the variable names (keys) are influenced by untrusted repository content, it could lead to command injection vulnerabilities within the generated script when it is executed by a human user.

wizard