The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions allow for shell command injection by interpolating the {scribe_base_url} and {app} variables directly into a curl command. If these variables contain shell metacharacters, they would be executed in the environment. Evidence: curl -s "https://{scribe_base_url}/metrics?app={app}&window=90d" in Phase 1 of the SKILL.md workflow.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources to generate the "Trend Context" narrative section of the report, creating a surface for prompt injection attacks.
Ingestion points: Data is fetched from a configurable Scribe DORA API and various Spinnaker tools (delivery:delivery-spinnaker, delivery:delivery-managed-delivery, delivery:delivery-execution-failure-analysis).
Boundary markers: None. The skill does not define delimiters or provide instructions to the agent to ignore potential instructions embedded in the fetched data.
Capability inventory: The skill has access to the shell (curl) and deployment management tools (delivery:*).
Sanitization: None. The instructions do not specify any validation, filtering, or escaping of the fetched JSON data before it is interpreted by the LLM.
[DATA_EXFILTRATION]: The skill uses a user-configurable base URL (scribe_base_url) for its metrics API. If set to an attacker-controlled endpoint, the skill would exfiltrate application names and deployment statistics to that external server via the curl command.

dora-lite-report