The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses execFileSync throughout its scripts (e.g., pf-adapter.js, pingone-adapter.js, rollback.js) to invoke the official pingcli utility for infrastructure management and API interactions. These calls are scoped to the vendor's toolset and use array-based arguments to prevent shell injection.
[INDIRECT_PROMPT_INJECTION]: The orchestrator ingests external JSON data from source systems (PingFederate bulk exports or PingOne for Enterprise JSON exports). This data is used to generate payloads for the destination system. The skill implements mitigation via sanitizeName and sanitizeDescription functions in pingone-adapter.js, which strip potentially malicious characters (such as backticks, dollar signs, and redirection symbols) from input fields before they are passed to the API.
[CREDENTIALS_UNSAFE]: The skill is designed to handle sensitive credentials including administrative passwords and OIDC client secrets. It manages these through a combination of command-line flags and the PINGONE_CLIENT_SECRET environment variable. The pingone-client-secret.js script explicitly warns users against passing secrets via CLI flags to prevent them from being stored in shell history or visible in process lists.

ping-migration