The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the creation of bash scripts that execute local shell commands, including file manipulations and interactions with the GitHub CLI (gh secret set, gh variable set).
[DATA_EXPOSURE]: The generated scripts are designed to read from and write to sensitive file paths, specifically .env files, to manage configuration and secrets. It also reads .github/workflows to identify required CI/CD secrets.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data (e.g., README.md, workflow files, and environment examples) to determine the necessary setup stages. This creates an attack surface where malicious content in those files could influence the instructions generated for the human user.
Ingestion points: Reads project files like .env.example, README, and .github/workflows/* (SKILL.md).
Boundary markers: None present; the agent is instructed to "Read the repo first" to identify required variables.
Capability inventory: The generated script can write to the filesystem (write_env), open browser URLs (open_url), and interact with GitHub secrets (set_secret).
Sanitization: No specific sanitization or validation of the ingested repository data is mentioned before it is used to scope the wizard's stages.
[PRIVILEGE_ESCALATION]: The instructions direct the agent to grant executable permissions (chmod +x) to the dynamically generated scripts.

wizard