The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external repositories and configuration files via scripts/inventory.sh. This represents an attack surface where malicious content within the audited files could attempt to influence the agent's behavior. • Ingestion points: The <path> argument provided to scripts/inventory.sh. • Boundary markers: The skill instructions emphasize structural fixes but the scripts themselves do not employ specific boundary markers (like unique delimiters) when outputting file content to the agent. • Capability inventory: The skill can execute shell scripts, check for file existence, and perform network reachability tests (curl). • Sanitization: scripts/inventory.sh includes a redact() function that uses regular expressions to mask common secret patterns (e.g., GitHub tokens, AWS keys, Stripe keys) before printing information to standard output.
[DATA_EXFILTRATION]: The skill identifies and accesses the paths of sensitive configuration files and environment variable names. • Exposure details: scripts/inventory.sh scans for sensitive files such as .env, .ssh/id_rsa, and .aws/credentials. scripts/probe.sh checks for the existence of private keys and cloud credentials. • Mitigation: The skill is documented as a read-only audit tool. The scripts are designed to report only the presence or names of these items, with sensitive values explicitly redacted or replaced with yes/no status indicators.
[COMMAND_EXECUTION]: The skill relies on shell scripts (scripts/inventory.sh and scripts/probe.sh) to perform its audit functions. These scripts execute commands such as jq, grep, curl, and python3 to extract metadata and verify system state. • Safety check: The scripts do not download external code and the probe.sh operations require explicit user consent according to the skill instructions.

agent-safety-audit