The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/extract_dockerfile_blocks.py utilizes importlib.util to dynamically load the analyze_dockerfile module from a path constructed at runtime (Path(__file__).resolve().parent / 'analyze_dockerfile.py'). While this is a standard local development pattern for testing and CI, it constitutes dynamic loading of executable content.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted user data (Dockerfiles and Compose files), which represents a vulnerability surface for indirect prompt injection.
Ingestion points: User-supplied files are ingested by scripts/analyze_dockerfile.py and scripts/analyze_compose.py for static analysis.
Boundary markers: The analysis scripts treat inputs strictly as text for linting and do not incorporate user instructions directly into the agent's prompt.
Capability inventory: The analyzer scripts are limited to text processing and stdout output; they do not perform network operations, file writes, or sensitive subprocess calls.
Sanitization: scripts/analyze_compose.py uses yaml.safe_load() to prevent unsafe deserialization of YAML content.
[COMMAND_EXECUTION]: The instructions in SKILL.md and README.md direct the agent to execute internal Python scripts using uv run and run external utilities such as npx dclint and hadolint via Docker. These commands are necessary and expected for the skill's primary function.
[EXTERNAL_DOWNLOADS]: The skill refers to downloading the uv installer from astral.sh and utilizing container images from ghcr.io and Docker Hub (e.g., hadolint/hadolint). These sources are well-known, reputable services in the software development ecosystem.

dockerfile-best-practices