The Agent Skills Directory

[PROMPT_INJECTION]: The skill's 'AUDIT mode' requires the agent to analyze untrusted data, such as source code, infrastructure manifests, and runtime evidence. This ingestion of external data creates a surface for indirect prompt injection, where malicious instructions embedded in the audited files could attempt to influence the agent's behavior.
Ingestion points: The skill processes user-supplied workloads, Dockerfiles, Kubernetes manifests, and application source code during security reviews.
Boundary markers: The instructions do not explicitly mandate the use of delimiters or 'ignore' instructions for the untrusted data being audited.
Capability inventory: The agent is directed to use tools for searching (grep), inspecting system specifications, and executing verification probes as part of its audit procedure.
Sanitization: The procedure lacks specific guidance for filtering or sanitizing the content of the audited files before they are processed by the model.
[CREDENTIALS_UNSAFE]: The file rules/03-containers-microvms.md contains a hardcoded dummy API key (sk-live-abc123) within a Dockerfile snippet. This is explicitly presented as a 'BAD' example of secret management for educational purposes.
[EXTERNAL_DOWNLOADS]: The skill templates reference well-known and trusted external resources for software distribution, such as GitHub, the Python Package Index (PyPI), and the Google Container Registry (gcr.io). These are used to provide standard, secure configuration examples.

sota-sandboxing