The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill includes documentation and examples in references/gotchas.md that utilize sudo to perform administrative tasks, such as removing system directories and extracting archives to /usr/local. Additionally, it recommends the use of chmod +x in references/gotchas.md and references/mappings.md to grant execution permissions to downloaded binaries.
[COMMAND_EXECUTION]: In references/gotchas.md, a provided example for installing a specific Go version uses a destructive command (rm -rf /usr/local/go) to clear previous installations. While the command is targeted at a specific path, it represents a high-risk operation if misused.
[EXTERNAL_DOWNLOADS]: The skill fetches assets and scripts from several well-known and established services:
Downloads official Go language binaries from Google's go.dev domain.
Fetches the Codecov CLI tool from the official codecov.io service.
Retrieves execution scripts from the GoReleaser website (goreleaser.com).
[REMOTE_CODE_EXECUTION]: Instructions in references/mappings.md provide a pattern for direct execution of a remote script using curl | bash targeting the official GoReleaser site.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is designed to read and process external configuration data from GitHub Actions workflow files and Bamboo specs files found in the repository.
Capability inventory: The skill possesses the ability to generate shell scripts, create CI pipelines on a TeamCity server via CLI tools, and programmatically store secrets.
Boundary markers: The workflow documentation encourages human review of generated content through "Needs review" and "Manual setup" flags, which acts as a mitigation strategy.
Sanitization: The provided files do not specify explicit sanitization or escaping mechanisms for the untrusted content imported from the external workflow files.

migrate-to-teamcity