The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches binaries for sops and age from official GitHub release pages during the setup process. These sources are recognized as well-known and trusted services.
Evidence: curl -fsSL -o ~/.local/bin/sops https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.amd64 in references/setup.md.
Evidence: curl -fsSL https://github.com/FiloSottile/age/releases/download/v1.3.1/age-v1.3.1-linux-amd64.tar.gz | tar xz in references/setup.md.
[COMMAND_EXECUTION]: Instructs the execution of shell commands for local tool installation, identity generation, and running applications with decrypted secrets.
Evidence: Use of chmod +x, age-keygen, pnpm secrets exec, and systemd-creds commands described in SKILL.md and references/setup.md.
[DATA_EXFILTRATION]: Provides the agent with the capability to read and manipulate sensitive environment variables stored in encrypted files. While this is the intended purpose of the skill, it involves high-trust access to repository secrets.
Ingestion points: Reads from secrets/dev.env and secrets/prod.env using sops commands.
Capability inventory: Can display secrets (pnpm secrets show), retrieve specific keys (pnpm secrets get), and execute processes with secret-injected environments (pnpm secrets exec).
Sanitization: The wrapper script tools/secrets.ts is described as isolating the child process environment and performing shell quoting to handle special characters.
[PROMPT_INJECTION]: The skill processes repository secret files which could serve as a surface for indirect prompt injection if malicious content is committed to the repository.
Ingestion points: Reads secrets/dev.env and secrets/prod.env (SKILL.md).
Boundary markers: Relies on standard dotenv formatting managed by a wrapper script; no explicit instructions are provided to the agent to disregard embedded directives within values.
Capability inventory: Executes shell commands through pnpm secrets exec which could be influenced by injected variables.
Sanitization: The wrapper script performs environment isolation by stripping encryption keys before child process execution.

using-sops