The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill pulls a Docker image from 'ghcr.io/happy520ai/unified-ai-system/mcp-server' using an immutable SHA256 digest. Although the use of pinned digests is a security best practice, the source is an external repository not associated with a pre-approved trusted vendor.
[COMMAND_EXECUTION]: The skill executes a sequence of powerful host commands to inspect the external image. This includes using 'docker export' and 'tar' to extract the image's root filesystem into a temporary directory, followed by 'find' and 'grep' operations to search for credentials, SUID/SGID files, and specific sensitive code patterns (e.g., child_process, fetch, process.env).
[DYNAMIC_EXECUTION]: The skill registers an MCP server using 'codex mcp add', which enables the execution of the downloaded image. While the registration command incorporates security mitigations such as '--network none', '--cap-drop ALL', and '--security-opt no-new-privileges', it still constitutes the execution of external binary content on the host.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests and reports data from multiple external tools (health checks, readiness probes, and workforce agents).
Ingestion points: Output from tools such as 'gateway_health', 'gateway_readiness', 'workflow_actions', and 'workforce_agents' (SKILL.md).
Boundary markers: The instructions command the agent to report results exactly, but there are no explicit delimiters or 'ignore embedded instructions' warnings for the data being processed.
Capability inventory: The skill utilizes Docker for tool execution and performs extensive host filesystem reads/writes during the audit phase.
Sanitization: No explicit sanitization or validation of the tool output is defined before it is processed by the agent.

unified-ai-gateway