The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes untrusted files from a plugin directory to compute integrity hashes.
Ingestion points: The hash_file(path) and audit_versions(config_path) functions in SKILL.md read contents from arbitrary files within a provided directory path.
Boundary markers: Absent; the logic processes raw file data without using delimiters or instructions to the agent to ignore potential malicious content embedded in the files.
Capability inventory: The skill is capable of reading the local file system (path.rglob, open().read()), writing manifest files (Path().write_text()), and executing Python scripts.
Sanitization: While the skill uses SHA-256 hashing to detect modifications, it does not sanitize the contents of the files before processing them, which is a common trait of diagnostic tools.- [DATA_EXFILTRATION]: The skill accesses local files, including project configuration and source code, to perform its auditing and manifest generation tasks.
Evidence: The hash_file function reads file contents in chunks, and audit_versions specifically reads package.json, requirements.txt, and pyproject.toml files.- [COMMAND_EXECUTION]: The skill contains Python snippets and a GitHub Actions workflow definition that facilitate the execution of commands.
Evidence: The CI integration section provides a python -c shell command to execute an inline Python script for manifest verification.- [EXTERNAL_DOWNLOADS]: The documentation references external resources and repositories for security standards and tools.
Evidence: Links to the OpenSSF SLSA project, npm documentation, and Microsoft's official agent-governance-toolkit repository are included for reference.

agent-supply-chain