The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Kubernetes manifests, ConfigMaps, and Secrets from user-provided repositories. This activity creates an ingestion point for indirect prompt injection attacks where malicious content in the repository could influence the agent's logic.
Ingestion points: The agent reads resource inventories, ConfigMap data for environment variables, and Kustomization post-build substitution literals (documented in SKILL.md Phases 1, 2, and 4).
Boundary markers: The instructions do not specify the use of delimiters or specific "ignore embedded instructions" warnings when the agent ingests content from the repository files.
Capability inventory: The skill executes shell scripts that invoke flux, flux-schema, and helm commands, and the agent is instructed to grep through generated manifest bundles.
Sanitization: The skill relies on the validation tools to process manifest content and does not implement separate sanitization of the values before the agent reviews them.
[COMMAND_EXECUTION]: The skill executes a suite of local shell scripts (scripts/discover.sh, scripts/validate.sh, scripts/check-deprecated.sh) which interact with the filesystem and invoke external binaries like flux and helm. While this is the intended primary purpose of the skill, it represents a powerful capability that operates on the user's local environment.
[DYNAMIC_EXECUTION]: The skill generates rendered Kubernetes manifests at runtime by executing kustomize build (via flux-schema) and helm template. It also instructs the agent to dynamically create .env files from repository data to facilitate variable substitution during validation. These generation and execution patterns are typical for auditing tools but involve runtime assembly of executable configuration.

gitops-repo-audit