The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it is designed to ingest and act upon untrusted configuration files from the user's local environment.
Ingestion points: The skill instructions in SKILL.md (Inspect First section) require the agent to read existing Docker Compose files (compose.yaml or docker-compose.yml) in full before performing any actions.
Boundary markers: The instructions do not specify the use of delimiters or provide warnings for the agent to ignore natural language instructions that might be embedded within the YAML files (e.g., in comments or metadata).
Capability inventory: The skill possesses the capability to execute shell commands via the docker compose CLI tool, including config, up, down, ps, and logs as described in SKILL.md.
Sanitization: There is no evidence of sanitization, validation, or escaping of the content read from the Compose files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is intended to execute local shell commands using the docker compose CLI. While these are documented capabilities for the skill's primary purpose, they form the functional part of the indirect prompt injection risk chain.

docker-compose