The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill allows the agent to fetch mock environment configurations from remote URLs using the --data flag in the start, import, and export commands. Examples in SKILL.md and references/commands.md demonstrate fetching data from https://example.com/mock-data.json.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON and YAML mock configuration files that support Handlebars-style templating. This creates a surface for indirect injection where a malicious configuration file could execute instructions via the templating engine.
Ingestion points: The agent reads untrusted data via the --data and --input flags in commands like mockoon-cli start and mockoon-cli import (defined in SKILL.md).
Boundary markers: None identified. The template engine processes the content of the provided configuration files without explicit isolation from the agent's instructions.
Capability inventory: The skill has the capability to read environment variables using the {{getEnvVar}} helper, as documented in references/templating.md. It can also generate responses based on request parameters (urlParam, queryParam, body).
Sanitization: The getEnvVar helper defaults to a MOCKOON_ prefix to limit exposure, but this can be overridden using the --env-vars-prefix flag, potentially allowing access to sensitive system secrets like AWS_SECRET_ACCESS_KEY if the mock file is crafted by an attacker.

mockoon-cli