The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill reads local project files like deployment.jsonc and .gitmodules to determine configuration. While these files could contain instructions intended to influence agent behavior, the skill mitigates this by requiring explicit operator approval for all mutations and enforcing strict validation rules.
Ingestion points: deployment.jsonc, package.json, .gitmodules, scripts/deploy.mjs, and README.md (referenced in SKILL.md).
Boundary markers: The instructions define strict "Operating Rules" and "Hard Stops" to constrain agent behavior and interpretation of data.
Capability inventory: The skill utilizes shell execution via pnpm, git, and wrangler for environment setup, testing, and deployment.
Sanitization: Account IDs and hostnames are validated against specific patterns, and production changes require a human-approved mutation summary.
[External Resource Management]: The skill manages Git submodules and package dependencies. It includes guidance on verifying submodule provenance and cautions against using unreviewed commits or unverified mirrors, supporting a secure supply chain approach.
[Local Command Execution]: The skill uses development tools like git, pnpm, and wrangler. These operations are scoped to the project directory and include identity verification steps using wrangler whoami to ensure the correct account is targeted.
[Secret Management]: The skill implements protective measures for secrets, advocating for interactive CLI tools for credential management rather than chat-based input. It provides instructions to verify secret existence without revealing their contents.

cloudflare-os-operator