The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently uses shell commands to perform infrastructure discovery and validate generated artifacts.
Evidence: references/phases/discover/discover-live.md uses the gcloud CLI for project inventory; references/phases/discover/discover-openai-api.md uses curl to fetch usage data; references/phases/generate/generate-artifacts-report.md executes a Python validator script.
Context: These operations are restricted to read-only actions. discover-live.md includes an explicit 'Security Contract' that whitelists allowed commands and prohibits the capture of sensitive metadata values or credentials.
[DYNAMIC_EXECUTION]: The skill generates and runs temporary Python or JavaScript scripts at runtime to process complex data sets without exceeding context limits.
Evidence: references/phases/discover/discover.md generates _extract_billing.py for billing data; references/phases/discover/discover-live.md generates _extract_live.py as a scale guard; references/phases/discover/discover-openai-api.md generates _capture_openai.py for API interaction.
Safety: These scripts are created using internal templates and are deleted immediately after execution. They operate locally on extracted data and do not download external executable content.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data including Terraform files, application source code, and billing exports.
Ingestion points: Data enters the agent's context during the discovery phase in discover.md (Steps 1a, 1b, 1c).
Boundary markers: The skill defines a mandatory 'Input Security' protocol in SKILL.md, instructing the agent to treat all user-supplied content strictly as data and to ignore any embedded directives or instructions intended to override agent behavior.
Capability inventory: The skill possesses the capability to execute shell commands, write files, and perform network requests, making injection prevention critical.
Sanitization: The skill performs automatic redaction of sensitive patterns (e.g., password, api_key) before persisting any extracted data into JSON artifacts.

gcp-to-aws