The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script setup.sh uses positional arguments ($1, $2) directly in shell commands (docker build and docker run) without validation or proper shell quoting. This allows for command injection if an attacker can control the values passed to the script.
[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to inspect project metadata files to determine the application's runtime. Malicious content within these files could influence the agent's actions during the containerization process.
Ingestion points: The agent reads package.json, requirements.txt, go.mod, and Cargo.toml from the local workspace to identify runtimes.
Boundary markers: No specific delimiters or instructions to ignore embedded prompts are provided when reading these external files.
Capability inventory: The skill possesses capabilities for file system modification (creating Dockerfiles) and shell command execution (via setup.sh or npm scripts).
Sanitization: The skill lacks validation or sanitization mechanisms for the data extracted from the project files before it is used to guide the agent's subsequent steps.

adding-docker