The Agent Skills Directory

[Build Hook Execution]: The skill uses a profile-owned build.sh script executed during the Docker build process. This provides a mechanism for custom installation logic, such as wrapping binary archives or performing cleanup, and is scoped specifically to the image construction phase.
[External Binary Downloads]: The instructions describe fetching runtime tools like Claude and Ollama. To maintain security, the skill specifies that these should be digest-bound official binary archives rather than mutable installer endpoints, ensuring the integrity of the downloaded components.
[Indirect Prompt Injection Surface]: The image builder ingests various profile-owned files, including package lists and configuration ledgers.
Ingestion points: Files like apt-packages.txt, build.sh, and profile.toml are read from the config/profiles/ directory.
Boundary markers: The system uses capsem-admin check to validate inputs against defined contracts before materialization.
Capability inventory: The system can execute shell commands via build.sh, perform package installations (apt, pip, npm), and generate EROFS images.
Sanitization: Inputs are parsed and validated using Pydantic models (e.g., GuestImageConfig) before being used in the build pipeline.
[Dynamic Configuration Generation]: The build system utilizes Jinja2 templates to dynamically generate Dockerfiles for both the rootfs and the kernel. This process relies on a materialized backend workspace that is validated by the capsem-admin tool prior to execution.
[Apt Security Consideration]: The build process configures APT to bypass certain time-validity checks (Acquire::Check-Valid-Until=false) to prevent failures caused by clock skew in containerized environments. This configuration is restricted to dependency-helper builds targeting specific HTTPS snapshot authorities.

build-images