The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill manages environments that ingest data from external repositories and provides capabilities to execute commands within those environments, creating a potential injection surface.
Ingestion points: Untrusted content can enter the sandbox environment via repository cloning (boat env add-repo) and file injection (boat env set-file or the PUT /sandboxes/{id}/files API).
Boundary markers: The skill includes instructions to minimize context leakage (e.g., "Never prepend the full user prompt", "remove copied conversation"), which serves as a mitigation, but does not implement explicit delimiters for external content.
Capability inventory: The skill possesses extensive control over sandboxes, including the ability to run arbitrary shell commands via the CLI (boat) and the API (POST /sandboxes/{id}/commands), and manipulate the file system.
Sanitization: There is no evidence of automated sanitization or verification of the content within cloned repositories before execution or processing by the agent.
[COMMAND_EXECUTION]: The skill relies on executing shell commands through the boat CLI and interacting with a remote command execution API to manage sandbox lifecycle and operations.

boat