The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing the kuva CLI tool from a third-party GitHub repository (github.com/Psy-Fer/kuva) using the Rust package manager. This involves downloading and installing unverified source code or binaries from an external, non-trusted source.
[COMMAND_EXECUTION]: The workflow involves executing several shell commands, including cargo install kuva --features cli and running the resulting kuva binary. It also executes the minister.dora_metrics Python module to perform core calculations.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from external sources like git logs and the GitHub API (specifically branch names and issue/PR labels) to generate performance reports. A malicious actor could inject instructions into these fields to manipulate the agent's summary or downstream actions.
Ingestion points: Git repository history and GitHub API metadata processed via the python3 -m minister.dora_metrics command.
Boundary markers: None; the instructions do not specify delimiters or warnings for the agent to ignore embedded instructions in the processed data.
Capability inventory: Shell execution of Python modules and external plotting binaries, and the ability to pipe data to other reporting tools.
Sanitization: No sanitization, validation, or escaping of ingested strings is described in the provided modules.

dora-metrics