The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The provided configuration files (e.g., app-config.yaml) correctly utilize environment variable placeholders such as ${GITHUB_TOKEN} and ${POSTGRES_PASSWORD} for managing sensitive credentials. This approach avoids hardcoding secrets and aligns with standard security practices for infrastructure-as-code and platform configuration. \n- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download and install various platform engineering tools from reputable and official sources. These include the official Helm repository for Crossplane (charts.crossplane.io), the official Homebrew tap for Score (score-spec/tap), and the standard Node.js package manager for Backstage plugins. These operations are transparent and target well-known developer tooling ecosystems. \n- [INDIRECT_PROMPT_INJECTION]: The Backstage Service Catalog configuration defines ingestion points that import metadata (catalog-info.yaml) from external GitHub repositories. While processing data from external sources represents a potential ingestion surface for indirect prompt injection, this is a core architectural feature of the described developer portal. The skill demonstrates standard organizational catalog management patterns. \n- [COMMAND_EXECUTION]: The skill provides documentation containing shell commands for environment setup, tool installation, and manifest generation. These commands are educational in nature, intended for the user to execute manually during the platform build process, and do not involve suspicious hidden execution or privilege escalation attempts.

platform-engineering