The Agent Skills Directory

[METADATA_POISONING]: The skill exhibits inconsistent metadata; the author is listed as 'mahipal' in the SKILL.md frontmatter, while the LICENSE file attributes copyright to 'mukul975'. This discrepancy can be misleading regarding the origin and ownership of the skill.
[EXTERNAL_DOWNLOADS]: The references/api-reference.md file includes instructions to install cert-manager from the jetstack repository. Jetstack is a well-known service provider, and this reference is consistent with the skill's purpose.
[COMMAND_EXECUTION]: The scripts/agent.py script performs several local system operations based on user input, including creating directories, writing private keys and certificates to the file system, and initiating network connections via socket.create_connection to verify remote TLS endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection. 1. Ingestion points: The audit_certificates function in scripts/agent.py reads and parses PEM certificate files from a directory provided by the user. 2. Boundary markers: None are used when including extracted certificate metadata in the final audit report. 3. Capability inventory: The script has capabilities for local file writing and network connectivity. 4. Sanitization: Content extracted from certificates is handled as raw strings by the cryptography library and no additional sanitization is applied before reporting.

implementing-mtls-for-zero-trust-services