The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection within the SKILL.md file to run shell commands automatically when the skill is loaded. These commands check for the presence of a migrations/ directory and verify that the required CONTENTFUL environment variables are present in local .env or .env.local files. The environment variable check is performed using grep and sed to mask the actual values of the secrets, preventing them from being exposed to the agent or user interface.
[INDIRECT_PROMPT_INJECTION]: This skill operates by reading and executing migration scripts from the local migrations/ directory. This creates a vulnerability surface where a malicious script could be placed in that folder and subsequently executed by the agent.
Ingestion points: User-provided migration scripts located in the migrations/ directory.
Boundary markers: None identified.
Capability inventory: The skill has the capability to execute shell commands via npx and perform management operations on Contentful spaces.
Sanitization: The skill does not implement automated sanitization or validation of the contents of the migration scripts prior to execution.

contentful-migration