The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to extract build options (e.g., NATIVE_IMAGE_OPTIONS) from untrusted local project files and use them to construct shell commands. A malicious repository could provide specially-crafted options to execute arbitrary commands on the host system or within the builder container.
[PRIVILEGE_ESCALATION]: The instructions recommend mounting the host's container socket (e.g., /run/user/1000/podman/podman.sock) into the builder container to support Testcontainers. This gives the builder container full control over the host's container engine, allowing for potential container escapes or host compromise.
[PRIVILEGE_ESCALATION]: The skill uses the --security-opt label=disable flag in container execution commands, which disables SELinux isolation for the container, reducing the security posture of the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions found in untrusted project data such as CI configurations and README files.
Ingestion points: Local project files like .github/workflows, build.gradle, and pom.xml are read using rg to determine build parameters.
Boundary markers: None. The agent is encouraged to follow the project's existing build settings directly.
Capability inventory: The skill performs file system mounts, environment variable injection, and shell command execution.
Sanitization: There is no evidence of sanitization or validation of the values extracted from the project files before they are used in command-line construction.
[EXTERNAL_DOWNLOADS]: The skill fetches official GraalVM builder images from Oracle's container registry and GitHub Container Registry (GHCR). These are well-known and trusted sources.

graalvm-native-build