The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses eval and source /dev/stdin to execute shell commands dynamically generated from the output of secret management tools such as HashiCorp Vault, AWS CLI, and 1Password CLI. This is a high-risk pattern as it executes data retrieved from external services or command outputs.
SKILL.md: eval $(vault kv get -format=json ... | jq ...)
SKILL.md: eval $(aws ssm get-parameters-by-path ... | awk ...)
SKILL.md: op item get ... | jq ... | source /dev/stdin
[DYNAMIC_EXECUTION]: The environment example generation script in EXTENDED.md uses a Python heredoc to generate and execute code at runtime.
EXTENDED.md: `python3
"$INPUT" "$OUTPUT" << 'PYEOF'`
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from git logs and pull request diffs which could contain hidden instructions targeting the agent during auditing or rotation tasks.
Ingestion points: git log --all -p and gh pr diff in SKILL.md.
Boundary markers: The instructions lack delimiters or warnings to ignore instructions embedded within the ingested git data.
Capability inventory: The skill can perform sensitive operations including writing to secret managers (vault kv put, aws ssm put-parameter), rewriting git history (git filter-repo), and dynamic shell execution (eval).
Sanitization: There is no evidence of sanitization or filtering of the external git/PR content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill automates the installation of a git pre-commit hook that executes local shell scripts, which is a form of persistent command execution within the project environment.
SKILL.md: cat > ".git/hooks/pre-commit" << 'HOOK'
[EXTERNAL_DOWNLOADS]: The skill references and integrates with external security tools and repositories from well-known providers.
SKILL.md: References the gitleaks repository for secret scanning.

env-secrets-manager