The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external search results (bird search for social media and web_search for general web results) to determine the topic, scope, and API design of new agents. This creates an attack surface where adversarial content in search results could attempt to influence the agent's logic or design.
Ingestion points: Data enters the pipeline via bird search results (Step 1) and web_search results (Step 3).
Boundary markers: No explicit delimiters or instructions to ignore embedded prompts in the search data are present.
Capability inventory: The skill possesses significant capabilities including repository creation (gh repo create), cloud service deployment (railway up), and network operations (curl).
Sanitization: There is no evidence of filtering, escaping, or validation of the external search data before it is used to define agent parameters.
[COMMAND_EXECUTION]: The skill orchestrates multiple CLI tools to perform its tasks, including gh for GitHub repository management, railway for deployment and environment configuration, and curl for verifying external API endpoints.
[CREDENTIALS_UNSAFE]: The documentation instructs users to export sensitive authentication tokens (RAILWAY_TOKEN, AUTH_TOKEN, CT0) as environment variables. While this is standard practice for CLI-based automation, these credentials provide broad access to the associated user accounts and services.

agent-factory