The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources that could contain malicious instructions.
Ingestion points: The skill fetches issue details (title, body, labels) from GitHub, GitLab, and Azure DevOps via alera workspace issue show (references/workspaces.md). It also reads incoming messages from other agents via alera inbox wait (references/inbox.md).
Boundary markers: The documentation does not specify the use of delimiters or 'ignore embedded instructions' warnings when processing this external content.
Capability inventory: The skill has extensive capabilities including writing to terminals (alera terminal write), installing skills (alera skill install), and managing SSH hosts.
Sanitization: No mention of sanitization or escaping of the ingested data is provided in the documentation.
[DATA_EXFILTRATION]: The alera webhook add command (references/mcp.md) allows the runtime to send events, including inbox replies and agent states, to arbitrary external HTTPS URLs. This provides a direct mechanism for data exfiltration if an attacker can influence the configuration.
[PERSISTENCE]: The alera automation create command (references/automations.md) supports scheduling persistent agent tasks using cron expressions. This allows for long-term execution of logic across sessions.
[REMOTE_CODE_EXECUTION]: The alera skill install command (SKILL.md) allows the installation of new skills into the runtime. This involves downloading and executing external logic, which is a form of remote code execution, although here it is used for platform extensibility.
[COMMAND_EXECUTION]: The skill makes extensive use of the alera CLI to perform system-level operations, such as managing Git worktrees, SSH targets, and local processes.

alera-cli