The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository files (YAML, Python, Jinja2, etc.) and uses the Bash tool to perform audits. This creates an attack surface for indirect prompt injection; however, the skill mitigates this through a mandatory 'Phase 0' read-only constraint that forbids destructive commands and requires manual script inspection before execution.
Ingestion points: Files discovered and parsed as described in audit-procedure.md (Phases 1-6).
Capability inventory: Bash, Read, Write, Grep, Glob tools are permitted for auditing and report generation.
Boundary markers: Instructions require findings to be explicitly verified and cited against the audited version's models.
Sanitization: The auditor is instructed to verify if a script writes before running it for output.
[DYNAMIC_CONTEXT_INJECTION]: SKILL.md contains dynamic context placeholders using the ! prefix to execute find and cat commands. These are used safely to populate the agent's context with project structure and configuration data upon initialization.
[EXTERNAL_DOWNLOADS]: The skill references fetching schema definitions (openapi.json) from local Infrahub service endpoints (e.g., http://localhost:8000). This is a functional requirement for validating naming limits and is restricted to local or whitelisted infrastructure.

infrahub-auditing-repo