The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to install a security tool using a high-risk command pattern where a script is downloaded from a remote URL and piped directly into the shell for execution. This pattern is vulnerable to supply chain attacks and man-in-the-middle interventions.\n
Evidence: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh in SKILL.md.\n- [CREDENTIALS_UNSAFE]: The Docker Compose template provided for local development includes hardcoded default credentials and connection strings with embedded passwords, which could be accidentally committed or deployed to production.\n
Evidence: DATABASE_URL=postgresql+asyncpg://postgres:postgres@db:5432/app_dev and POSTGRES_PASSWORD: postgres in references/docker-compose-template.yml.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests untrusted project files (such as requirements.txt and package.json) to generate Docker configurations. This creates a surface for indirect prompt injection if the processed files contain malicious instructions.\n
Ingestion points: Project dependency files and source code directories referenced in SKILL.md and template files.\n
Boundary markers: None provided to isolate untrusted data from the agent's instructions.\n
Capability inventory: The skill has access to file writing and Docker CLI tools via the Bash(docker:*) permission.\n
Sanitization: No validation or sanitization is performed on the content of external files.\n- [METADATA_POISONING]: The skill's internal metadata declares an author that does not match the platform-provided author information, which could be used to misrepresent the skill's origin.\n
Evidence: Metadata field author: platform-team in SKILL.md contradicts the platform-provided author context (hieutrtr).

docker-best-practices