The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project files from the current repository to generate test configurations that include executable shell commands.\n
Ingestion points: The skill reads README*, documentation directories (docs/, *.mdx), package manifests (package.json, pyproject.toml, go.mod, Cargo.toml), and existing firegoat.yaml files.\n
Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore potentially malicious directions embedded within the project files.\n
Capability inventory: The skill generates firegoat.yaml configurations containing build, install, cleanup, and checks fields, all of which support arbitrary shell command execution.\n
Sanitization: The skill does not perform sanitization or validation of the repository content before using it to generate the shell commands in the test configuration.\n- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the agent to run the firegoat package from the npm registry using npx -y firegoat@latest eval. This involves downloading and executing remote code from a public registry, which is the standard method for using the vendor's own testing utility.\n- [COMMAND_EXECUTION]: The skill drafts a firegoat.yaml configuration that includes shell commands for building, installing, and validating software. These commands are executed by the firegoat CLI during the evaluation process.

firegoat-onboarding