The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes application manifests (manifest.yml) and variable files (vars.yml) which are untrusted external inputs. An attacker could embed instructions in these files to influence agent behavior during deployment or troubleshooting tasks.
Ingestion points: cf push -f manifest.yml, cf push --vars-file vars.yml, and cf apply-manifest -f manifest.yml in SKILL.md.
Boundary markers: None present; the agent is not instructed to ignore embedded instructions in these files.
Capability inventory: The skill uses cf push (deployment), cf ssh (shell access to containers), cf set-env (environment modification), and cf curl (arbitrary API calls).
Sanitization: No explicit sanitization or validation of manifest content is mentioned.
[EXTERNAL_DOWNLOADS]: The skill suggests installing the MTA Build Tool via npm install -g mbt and the multiapps CF CLI plugin via cf install-plugin multiapps. These are standard tools for the SAP and Cloud Foundry ecosystems and are consistent with the skill's stated purpose and author context.
[COMMAND_EXECUTION]: The skill documentation includes commands for interactive and non-interactive authentication (cf login, cf auth), container access (cf ssh), and direct API interaction (cf curl). While these are standard administrative tools, they provide significant control over the Cloud Foundry environment.
[DATA_EXFILTRATION]: The skill mentions the cf oauth-token command, which outputs the current session's access token to the terminal, and cf env, which displays environment variables including potentially sensitive service credentials in VCAP_SERVICES.

cf-cli