The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the cerbos CLI and docker to validate policies via cerbos compile. These operations are restricted within the allowed-tools configuration and are essential for the skill's stated purpose of policy validation.
[EXTERNAL_DOWNLOADS]: The skill references official vendor resources for documentation, schema validation, and tool installation, including docs.cerbos.dev, hub.cerbos.cloud, ghcr.io/cerbos/cerbos, and the cerbos/cerbos GitHub repository. These are trusted vendor domains for the author 'cerbos'.
[DYNAMIC_EXECUTION]: The provided script scripts/coverage_audit.py performs automated audits of generated test suites. It executes the cerbos compile binary using subprocess.run to generate machine-readable validation reports. The script uses a safe YAML loader (inheriting from yaml.SafeLoader) and includes a manual subset-YAML parser to avoid unsafe deserialization risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied authorization requirements to generate code. It mitigates logic errors and injection risks by requiring a 'Structured Intent' checklist, producing a compact spec for user confirmation, and mandating a 'coverage plan' that is audited by an independent reviewer subagent and the execution of a coverage audit script.
[CREDENTIALS_SAFE]: The skill follows secure practices for handling Cerbos Hub secrets, explicitly instructing the user to use environment variables (CERBOS_HUB_CLIENT_SECRET) and warning against including secrets in command history or transcripts.

cerbos-policy