The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill relies on reading external, potentially untrusted data from the local project repository to determine its available commands and logic. An attacker could place malicious instructions in .ddev/commands/ or the ddev help output to compromise the agent's session. 1. Ingestion points: The agent reads contents from .ddev/commands/host, .ddev/commands/web, and the output of ddev help. 2. Boundary markers: No specific delimiters or warnings to ignore embedded instructions are provided when reading these files. 3. Capability inventory: The skill allows for the execution of various DDEV commands including ddev init, ddev start, and ddev db-refresh, which can involve complex shell operations and data transfers. 4. Sanitization: There is no evidence of sanitization or validation of the text read from the command files before it is processed by the agent.
[COMMAND_EXECUTION]: The skill facilitates the execution of shell commands through the DDEV CLI tool. While these are intended for development tasks, the skill passes user-provided arguments directly to commands like ddev theme-npm and ddev theme-npx , representing a command execution surface if inputs are not properly handled.

ddev-workflow