The Agent Skills Directory

[DATA_EXFILTRATION]: The skill explicitly instructs the agent to read sensitive local files to understand the current configuration state.
Evidence: The 'Scope the procedure' section in SKILL.md (and its translation) directs the agent to read .env, .env.example, .env.*, and .github/workflows/* (specifically checking for secrets.* and vars.* references).
Risk: Accessing active environment files exposes existing secrets to the agent's context.
[INDIRECT_PROMPT_INJECTION]: The skill relies on analyzing untrusted repository files to determine the steps for the wizard.
Ingestion points: The agent reads README, docker-compose*, framework config, and other repository files to 'work out every manual step'.
Capability inventory: The agent-generated scripts can write to .env files and set GitHub repository secrets via the gh CLI.
Boundary markers: There are no instructions for the agent to use delimiters or ignore embedded instructions within the data it reads from the repository.
Sanitization: No explicit sanitization of the discovered values or paths is required before they are used in the generated bash script.
[DYNAMIC_EXECUTION]: The skill's primary function is to generate and hand off executable bash scripts.
The agent constructs a script by combining the provided template.sh library with custom-authored 'stages'.
The generated scripts are intended to be executed by the user to perform system configuration, including environment file writes and CLI tool interactions.
Mitigation: The instructions require the agent to show the plan to the user for confirmation and suggest static verification (bash -n, shellcheck) before running.

wizard