The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/check_compose_guardrails.py script uses subprocess.run to call docker compose config. It uses a list of arguments to pass the file path, which safely avoids shell interpolation and injection risks.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface. The scripts/resolve.py script reads configuration and profile files from the target repository and writes them to a local cache. The SKILL.md then instructs the agent to read and follow these potentially untrusted instructions.
Ingestion points: Configuration files are read from the repository's .agents/skills-config/docker-compose-guardrails/ directory.
Boundary markers: The resolver uses Markdown headers to separate generic and project-specific instructions, but lacks explicit guardrails against instructions embedded in the project data.
Capability inventory: The skill can execute docker compose config via its scripts and suggests the use of docker inspect for verification.
Sanitization: Path containment checks in resolve.py prevent directory traversal when resolving configuration files.

docker-compose-guardrails