The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to parse and analyze untrusted third-party data to automate machine configuration, which presents a surface for indirect prompt injection.
Ingestion points: In references/machines.md, the agent is instructed to read CI workflows, AGENTS.md, agent.md, and README.md files from registered repositories to discover components and configuration settings.
Boundary markers: The skill does not define clear boundary markers or specific "ignore" delimiters when processing these untrusted files, although it does provide a general warning to treat them as untrusted.
Capability inventory: The agent has extensive capabilities via the islo CLI, including file system writes, machine build/delete operations, and network-facing trigger configurations across multiple files.
Sanitization: The instructions advise the agent to "never expose secrets, credentials, environment values, or private data" discovered in these files, but it lacks programmatic sanitization for the instructions themselves.
[COMMAND_EXECUTION]: The skill makes heavy use of the islo CLI to manage resources. While these are vendor-provided tools, they involve powerful operations like islo ssh and islo factory machine build which execute logic based on potentially untrusted repository content.
[PRIVILEGE_ESCALATION]: The skill includes instructions to use elevated privileges for specific configuration tasks.
Evidence: In references/machines.md, the instructions for Local workspace commands and the Finalize step include sudo install -D -m 0644 /tmp/islo-machine-context.toml /etc/islo/machine.toml. This is used to install root-owned configuration files on the host system.

factory-lines