The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project configuration files to provision environments, which could serve as a vector for malicious instructions.
Ingestion points: Instructions in SKILL.md direct the agent to read docker-compose.yml, .env.test, jest.config.*, and pytest.ini from the project directory.
Boundary markers: The instructions do not define clear boundaries or provide warnings to the agent to ignore instructions found within these configuration files.
Capability inventory: The skill has the capability to write files and execute shell commands via the Bash tool (scoped to test:env-*), which could be misused if the agent follows instructions injected into the configuration files.
Sanitization: There is no evidence of validation or sanitization of the content ingested from these external files.

managing-test-environments