The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's repository, including environment variable files (.env) and application source code, to identify configuration requirements and set up secrets. This data is interpolated into shell commands and deployment workflows without explicit sanitization.
Ingestion points: Reads .env files, project source code (e.g., backend/internal/config/config.go), and deployment artifacts (provision-output.json).
Capability inventory: The skill possesses the ability to execute shell commands (gh, ssh, docker), create and modify GitHub Secrets, and perform remote operations on production VMs.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when the agent reads or processes the content of the user's files.
Sanitization: The skill lacks specific validation or sanitization logic for keys and values extracted from the user's repository before they are utilized in sensitive operations like gh secret set or infrastructure configuration.
[EXTERNAL_DOWNLOADS]: The skill installs necessary dependencies and utilizes remote deployment workflows from the vendor's official repositories.
Fetches the python-dotenv package and the kamal Ruby gem during the setup and deployment process.
References and executes the locaweb/locaweb-cloud-provision reusable GitHub workflow for infrastructure provisioning. These are official resources provided by the skill's author and align with the intended deployment functionality.
[COMMAND_EXECUTION]: The skill relies on a wide range of shell commands to perform deployment and maintenance tasks.
Utilizes the gh CLI for repository secret management and monitoring of GitHub Actions runs.
Executes ssh-keygen to create deployment keys and uses ssh to connect to and manage cloud VMs.
Runs docker and docker-compose commands (via Kamal) to orchestrate containerized applications and accessories.
[CREDENTIALS_UNSAFE]: The skill manages sensitive credentials but adheres to secure practices for deployment automation.
It generates Ed25519 SSH keys and stores them as GitHub Secrets rather than in plain text.
It facilitates the configuration of CloudStack API and Secret keys by guiding the user to input them directly into GitHub's secret management UI.
Database passwords are generated randomly and handled through secure command-line interfaces to avoid exposure in logs or chat history.

cofounder-app-deploy