The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs dependencies including laravel/cloud-cli, resend/resend-php, and league/flysystem-aws-s3-v3 via Composer from official repositories. It also fetches documentation from https://cloud.laravel.com/docs/llms.txt using the WebFetch tool.
[COMMAND_EXECUTION]: The skill executes the cloud CLI tool to perform environment management, resource creation, and deployment operations. It instructs the agent to use specific flags such as -n and --json to manage output and prevent interactive prompts.
[REMOTE_CODE_EXECUTION]: The skill provides capabilities to execute PHP code via cloud tinker and shell commands via cloud command:run on remote Laravel Cloud environments. These functions are presented as standard administrative features.
[DATA_EXFILTRATION]: The skill manages sensitive information, including the LARAVEL_CLOUD_TOKEN and environment secrets. It accesses potentially sensitive files such as .env, ~/.config/cloud/config.json, and .cloud/config.json to manage credentials and application settings.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to how it handles external data:
Ingestion points: Documentation fetched from https://cloud.laravel.com/docs/llms.txt and the output of various CLI commands such as cloud deployment:logs or cloud usage (found in SKILL.md).
Boundary markers: There are no instructions for the agent to use delimiters or ignore potential commands embedded within the fetched documentation or command outputs.
Capability inventory: The skill has the ability to execute shell commands, manage secrets, and run remote commands on cloud infrastructure (found in SKILL.md).
Sanitization: There is no mention of sanitization, filtering, or validation of the data retrieved from external sources or tool outputs.

deploying-to-cloud