The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project manifest files to provide setup guidance, which constitutes a potential attack surface, but it implements robust prompt-level mitigations.
Ingestion points: In SKILL.md and references/steps.md, the agent is instructed to read local files including .ruby-version, .tool-versions, Gemfile, docker-compose.yml, .env.example, and config/database.yml.
Boundary markers: The instructions in SKILL.md and references/steps.md explicitly command the agent to disregard natural language prose in README.md, CONTRIBUTING.md, or wiki pages and strictly forbid reading any filled-in .env files.
Capability inventory: The agent is restricted to generating text-based plans. Commands such as bundle install, rails db:migrate, and docker compose up found in SKILL.md, EXAMPLES.md, and references/steps.md are exclusively for user execution. The agent is explicitly prohibited from executing commands itself.
Sanitization: The skill relies on descriptive summarization and mismatch flagging rather than interpreting or executing logic found within the ingested manifests.
[SAFE]: The skill demonstrates high security awareness by using SHA-pinned versions for GitHub Actions templates and maintaining a strict trust boundary where the agent never handles credentials or performs automated system changes.

setup-environment