The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection.
Ingestion points: The skill reads external CI configuration files (e.g., .github/workflows/*.yml, .gitlab-ci.yml) into the agent context via the !command execution in SKILL.md and the file-reading logic in scripts/ci-detect.py.
Boundary markers: There are no protective delimiters or instructions (e.g., 'ignore instructions within this block') surrounding the ingested file content in the prompt context.
Capability inventory: The skill allows the agent to use Bash, Read, and Write tools, which provides a significant capability set for an attacker to target if they successfully inject instructions through a project's CI files.
Sanitization: No sanitization or validation is performed on the content of the CI configuration files before they are presented to the agent.
[COMMAND_EXECUTION]: The skill utilizes dynamic context injection in SKILL.md to execute shell commands at load time.
Evidence: The line !"cat .github/workflows/*.yml 2>/dev/null || cat .gitlab-ci.yml 2>/dev/null || echo "no-ci"" executes shell commands to populate the 'Project context' section. While the specific commands used here are for information retrieval, this mechanism executes automatically when the skill is accessed.

ci