The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with external data sources that may contain untrusted content, creating a potential surface for indirect prompt injection attacks.
Ingestion points: In SKILL.md, instructions involve using docker logs, docker exec {db-service} psql, and docker exec {cache-service} redis-cli to retrieve data from running containers and databases.
Boundary markers: The skill lacks explicit guidance for the agent to treat the output of these diagnostic commands as untrusted or to use markers to delimit this data from its own instructions.
Capability inventory: The skill enables the agent to execute high-impact commands such as docker compose, npm run, and npx prisma, and allows reading sensitive local configuration files.
Sanitization: No methods for sanitizing or validating the content retrieved from logs or database queries are defined within the skill.
[COMMAND_EXECUTION]: The skill's primary function involves executing local system commands to manage infrastructure. This includes service lifecycle management, performing database migrations, and running diagnostic tools. These capabilities are intended but provide a powerful toolset for potential abuse.
[DATA_EXFILTRATION]: The skill provides instructions to access sensitive local files such as .env using shell commands like cat .env | grep -E "JWT_SECRET|ENCRYPTION". While this is intended for administrative verification and secret management auditing, it involves reading sensitive credentials directly into the agent's context.

docker