The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection. It is instructed to read local repository files like README.md, .env, and configuration files to derive automation stages. A maliciously crafted file in a repository could attempt to influence the AI to generate scripts that include unauthorized URLs or data handling steps.
Ingestion points: The skill reads .env, .env.example, README, docker-compose, and GitHub workflow files to scope the manual procedure.
Boundary markers: There are no explicit instructions for the AI to use delimiters or 'ignore' warnings when processing untrusted repository content.
Capability inventory: The generated scripts have the capability to write to local files, interact with the GitHub CLI to set secrets, and open URLs in the user's browser.
Sanitization: The skill instructions do not specify sanitization or validation logic for the data extracted from the repository files.
[COMMAND_EXECUTION]: The core purpose of the skill is to generate scripts that execute shell commands. These commands are intended to facilitate development tasks, such as upserting key-value pairs in environment files and configuring GitHub Actions secrets using the gh CLI tool.
[DATA_EXFILTRATION]: The generated scripts are designed to collect sensitive credentials (e.g., API keys) via interactive prompts and store them in .env files or transmit them to GitHub via its official CLI. While this is the intended functionality for project setup, it involves the direct handling of sensitive information.

wizard