The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves build data (such as names, scm_path, and metadata) from an external ZenTao instance via zentao-cli build list and zentao-cli build get. This data is then processed by the agent, creating a surface for indirect prompt injection if an attacker can manipulate build information within ZenTao.
Ingestion points: Data returned from zentao-cli build list and zentao-cli build get commands as described in SKILL.md and reference files.
Boundary markers: None. The skill does not specify delimiters or instructions to ignore potential commands within the retrieved data.
Capability inventory: The skill can execute commands to create, update, and delete builds using zentao-cli.
Sanitization: None. There is no evidence of filtering or validation of the data returned by the CLI before it is presented to the agent.
[DATA_EXPOSURE]: The SKILL.md file contains troubleshooting instructions in the 'Error Handling' section that suggest executing echo $ZENTAO_TOKEN. If the agent follows these instructions, it will output the sensitive authentication token into the chat context or logs, which constitutes credential exposure.

zentao-build