The Agent Skills Directory

[SAFE]: The skill demonstrates professional security practices by using multi-stage Docker builds and enforcing non-root user execution (USER nodejs) to minimize the container attack surface.
[SAFE]: Automated security scanning is integrated into the CI/CD pipeline templates using well-known services (Snyk, Trivy, and npm audit), ensuring dependencies and filesystems are checked for vulnerabilities during deployment.
[SAFE]: Secrets management follows best practices by using CI/CD platform secret stores (e.g., ${{ secrets.SNYK_TOKEN }}) rather than hardcoding credentials.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project documentation to generate infrastructure code, which is a necessary surface for its automation purpose. The risk is considered low due to the primary use case and the inclusion of security gates.
Ingestion points: Loads DEVELOPMENT_PLAN.md, ARCHITECTURE.md, and README.md in Phase 1, Step 1.1.
Boundary markers: No explicit delimiters or "ignore instructions" warnings are present in the interpolation steps.
Capability inventory: The skill involves writing infrastructure files (YAML, HCL) and executing CLI tools including terraform, kubectl, and npm.
Sanitization: No automated sanitization of the input documentation content is specified before code generation.

devops-role-skill