The Agent Skills Directory

[SAFE]: The skill documents the Atmos component vendoring system, focusing on configuration management and dependency tracking.
[CREDENTIALS_UNSAFE]: No hardcoded secrets were found. The documentation correctly guides users to use environment variables like ATMOS_GITHUB_TOKEN and GITHUB_TOKEN for authentication, which is a secure practice for managing API access.
[EXTERNAL_DOWNLOADS]: The skill describes downloading external components from Git repositories, Amazon S3, Google Cloud Storage, and OCI registries. These operations are the primary intended function of the vendoring tool. The documentation lists well-known and trusted domains and provides guidelines for secure version pinning.
[DATA_EXFILTRATION]: Network operations are restricted to fetching dependencies from declared sources. There is no evidence of unauthorized data collection or exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill processes manifest files (vendor.yaml, component.yaml) which represents an ingestion surface. However, this is categorized as safe as it is a core functional requirement for infrastructure configuration where the user maintains control over the manifest content. Capability inventory includes CLI-based file system writes and network reads.
[DYNAMIC_EXECUTION]: The skill documents the use of Go templates and Sprig functions within vendor manifests. This is a feature of the Atmos configuration engine and does not introduce security risks in the context of this documentation.

atmos-vendoring