The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is designed to ingest and follow instructions found within the repository it is processing.
Ingestion points: The agent is explicitly instructed to read files such as .env, .env.example, README, docker-compose*, and .github/workflows/* to scope the procedure (SKILL.md).
Boundary markers: There are no instructions to use delimiters or ignore potentially malicious embedded instructions within the ingested repository data.
Capability inventory: The generated scripts have the capability to write to the filesystem (write_env), execute the GitHub CLI (set_secret, set_var), and open URLs in the user's browser (open_url) (template.sh).
Sanitization: The skill lacks explicit sanitization or verification steps to ensure that instructions extracted from the repository files are not malicious or deceptive.
[COMMAND_EXECUTION]: The skill generates bash scripts that interact with the local environment and the gh CLI. While the template provided is structured, the AI-generated logic determines the final commands executed by the user.
[DATA_EXFILTRATION]: The core functionality involves capturing sensitive user input (API keys, secrets) and transmitting them to GitHub via gh secret set. While this is an intended feature for setup, the mechanism could be repurposed for exfiltration if the prompt context is manipulated via indirect injection.

wizard