The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (Markdown and TOML files) from a target repository. It mitigates injection risks by implementing a strict sanitize function in _common.py that escapes control characters, bidirectional (BIDI) text, and invisible Unicode characters before the data is presented to the agent. Furthermore, the SKILL.md explicitly instructs the agent to treat such output as data and ignore any embedded instructions.
[REMOTE_CODE_EXECUTION]: The skill downloads and installs a static site generator from a vendor-owned GitHub repository (Fandhe-AI/fandhe-frontend). This is done using cargo install --git with a specific commit hash (FF_REV) for supply chain security. It also fetches license text from raw.githubusercontent.com. Both are well-known/trusted sources for this vendor, and the URLs are strictly validated.
[COMMAND_EXECUTION]: The skill uses subprocess.run() in scaffold.py and build-local.sh to interact with standard development tools like git and gh. These calls are restricted to specific, safe operations (like getting repository configuration) and the outputs are processed using strict regex validation.
[PRIVILEGE_ESCALATION]: The skill implements robust path guards in _common.py (resolves_inside and write_target_problem). These ensure that the skill can only read or write files within the target repository's root and specifically blocks access to the .git directory, preventing unauthorized access to sensitive repository metadata or configuration.
[OBFUSCATION]: A static detector flagged Unicode steganography in tests/test_rebrand.py. Analysis confirms this is a test case designed to verify the skill's own sanitization logic against steganographic prompt injection, which is a security feature rather than a threat.

setup-github-pages