The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill is designed to ingest untrusted metadata (data schemas and producer/consumer agreements) and interpolate it into generated technical artifacts such as YAML configurations and validation scripts. This creates a surface where malicious instructions embedded in a schema could influence automated processes.
Ingestion points: Trigger and Input Context sections in SKILL.md.
Boundary markers: Absent. The agent is not instructed to isolate or ignore instructions within the ingested data.
Capability inventory: Generates Python scripts and GitHub Action workflows that perform file operations and shell commands (references/contract-enforcement.md, references/data-contracts-schema-evolution.md).
Sanitization: Absent. The skill directly translates input descriptions into functional logic.
[COMMAND_EXECUTION]: Vulnerable Command Construction in Examples. The CI/CD validation examples in references/contract-enforcement.md contain a command injection vulnerability. Specifically, the script uses $(basename $contract .yaml) inside a double-quoted string in a shell loop. This allows filenames containing command substitution patterns (e.g., $(touch executed).yaml) to execute arbitrary code when processed by the shell.
[SAFE]: Technical Bloat and Noise Injection. Eight reference files (e.g., references/architecture-patterns.md, references/security-best-practices.md) contain 150 sections of identical, repetitive technical filler text. While no specific malicious payload was identified within this content, such massive bloat (noise injection) can be used to manipulate model context or conceal hidden instructions.
[EXTERNAL_DOWNLOADS]: The GitHub Action examples reference standard and established actions (actions/checkout, actions/setup-python) and install common libraries from official registries (pyyaml, jsonschema).

data-data-contracts