The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves scanning repository files to define a workflow, creating a significant attack surface for indirect prompt injection.
Ingestion points: In SKILL.md Step 1, the agent is instructed to read .env, .env.example, README, docker-compose*, and .github/workflows/* to determine required secrets and setup stages.
Boundary markers: Absent. There are no instructions for the agent to distinguish between legitimate configuration data and adversarial instructions embedded within these files.
Capability inventory: The skill generates a script that uses open_url, ask_secret, write_env, and set_secret (using the GitHub CLI). A compromised workflow could trick a user into pasting sensitive credentials into a script that then 'sets' them to an attacker-controlled GitHub environment or directs the user to a phishing URL.
Sanitization: None. The agent is encouraged to follow the instructions found in the repository files literally to build the 'journey' for each stage.
[COMMAND_EXECUTION]: The skill involves the generation and preparation of executable code.
The agent is instructed to perform bash -n <script> to verify syntax and chmod +x <script> to make the generated file executable. While the agent is advised not to run the script itself, it actively prepares AI-generated code for immediate execution by the user.

wizard