The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The deployment script template in references/templates/DeployScript.sh.md includes the use of sudo to reload the PHP-FPM service (sudo -S service $FORGE_PHP_FPM reload), which represents a request for elevated system permissions.
[COMMAND_EXECUTION]: The custom Artisan command template references/templates/SetupPermissions.php.md contains logic to truncate database tables. If the --fresh option is invoked, the script executes truncate() operations on model_has_permissions, model_has_roles, and role_has_permissions, which are destructive operations that could lead to data loss if mismanaged.
[EXTERNAL_DOWNLOADS]: The skill's deployment and CI/CD templates reference external resources and packages.
The GitHub Actions workflow in references/templates/DeployScript.sh.md fetches the shivammathur/setup-php@v2 action, a well-known community service for setting up PHP environments.
The deploy.sh script executes composer install and git fetch, which are standard operations for fetching external dependencies and code updates.
[INDIRECT_PROMPT_INJECTION]: The skill defines a significant attack surface for indirect injection by processing role and permission names from various data sources.
Ingestion points: User-defined role and permission names in SetupPermissions.php.md, ApiPermissionSeeder.php.md, and route parameters in TeamMiddleware.php.md.
Boundary markers: None explicitly implemented in the logic that processes these identifiers.
Capability inventory: The skill has the capability to modify database state, assign administrative privileges (Super-Admin), and reload system services.
Sanitization: The implementation relies on Laravel's Eloquent ORM and built-in validation, but the interpretation of permission strings is a natural language processing task for the agent.

laravel-permission