The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from multiple external sources and has access to powerful tools like Bash and WebFetch.
Ingestion points: The agent reads container logs (kubectl logs), deployment manifests (kubectl get -o yaml), database migration tables (SELECT MAX(version)), and external HTTP responses from CDNs and feature flag APIs.
Boundary markers: Absent. The instructions do not provide explicit delimiters or warnings to ignore instructions that might be embedded within logs or external data streams.
Capability inventory: The agent can execute arbitrary shell commands via the Bash tool (including kubectl, helm, and yq) and make network requests via WebFetch.
Sanitization: Absent. No logic is defined to validate, filter, or escape the content retrieved from external sources before the agent processes it.
[COMMAND_EXECUTION]: The skill relies extensively on shell command execution to interact with infrastructure. It uses kubectl to query pod status, read logs, and execute commands within running containers (kubectl exec), which grants the agent significant control over the environment.
[CREDENTIALS_UNSAFE]: To verify deployment success, the skill explicitly directs the agent to retrieve and inspect environment variables from live containers (kubectl exec -n <ns> deploy/<app> -- env | grep <KEY>). This exposes potentially sensitive secrets and configuration data to the agent's execution context.

pre-ship-gate