The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process untrusted data from Dockerfiles and Compose configurations while having powerful shell and file system capabilities.
Ingestion points: The skill triggers on and reads Dockerfile, Containerfile, docker-compose.yml, compose.yml, and docker-bake.hcl files found in the user's repository context.
Boundary markers: There are no specific instructions or delimiters defined in the skill to help the agent distinguish between legitimate configuration data and potential malicious instructions embedded in these files (e.g., in comments).
Capability inventory: The agent is granted Bash access (specifically for docker and grep commands), along with Read, Write, Glob, and Grep file system permissions.
Sanitization: The instructions do not include steps for sanitizing or validating the content of the ingested files before they are used in tool invocations or prompt completions.

docker-development