The Agent Skills Directory

[Secure Configuration Guidance]: The skill provides detailed instructions on creating agent.yaml files while prioritizing security. It explicitly warns against hardcoding API keys and sensitive data, recommending the use of environment variables or the docker agent setup command for credential management.
[Mitigation of Data Exposure]: The documentation highlights the redact_secrets: true feature as a defense-in-depth measure to scrub sensitive patterns from agent interactions and tool outputs. It also explains the risks of variable interpolation (${env.VAR}) which can inadvertently disclose secrets to the model if not handled carefully.
[Least Privilege Principles]: The skill encourages applying restrictions to agents, such as using readonly: true for reviewer agents and setting max_iterations to prevent runaway loops. It also describes how to limit toolsets to only the necessary capabilities required for the agent's specific role.
[Trusted Vendor Integration]: All external resources, including the MCP catalog and documentation links, point to official Docker domains and repositories. The guidance on using OCI references for sub-agents includes best practices like pinning to digests for increased security and reliability, representing standard vendor-aligned functionality.

docker-agent-config