The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Kubernetes workloads, ConfigMaps, Secrets, and Signadot specifications, which creates a potential surface for indirect prompt injection.
Ingestion points: Kubernetes workload objects, ConfigMaps, Secrets, and repository-level Signadot configuration files referenced in references/sandbox-setup.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard instructions embedded within the ingested cluster metadata.
Capability inventory: The skill is capable of executing shell commands via eval, spawning background processes with setsid/nohup, and performing network requests using curl and grpcurl as described in SKILL.md and references/sandbox-setup.md.
Sanitization: The skill explicitly requires redacting secret values but lacks general sanitization for other metadata fields that could be used for instruction injection.
[DYNAMIC_EXECUTION]: The skill uses eval to execute shell commands generated by the signadot sandbox get-env CLI tool to reconstruct environment variables (SKILL.md, references/sandbox-setup.md). This pattern of executing externally generated strings is a dynamic execution risk, although it utilizes the vendor's own CLI.
[COMMAND_EXECUTION]: The skill manages the lifecycle of local microservices by executing arbitrary build and run commands defined in the user's repository (e.g., Makefile, package.json). It also utilizes system commands like setsid, nohup, lsof, and kill to handle background processes and port management (references/sandbox-setup.md, references/troubleshooting.md).

signadot-validate