The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The instructions in SKILL.md direct the agent to read .env and .env.* files to identify which environment variables are required for the setup process. While the skill advises looking only for key names, the process of reading these files exposes the secret values they contain to the model context.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted sources within the repository, such as README files and configuration files, to determine the stages of the generated script.
Ingestion points: The agent is instructed to read README, docker-compose*, and .github/workflows/* files (found in SKILL.md).
Boundary markers: There are no explicit instructions or markers to prevent the agent from following adversarial instructions embedded in these files.
Capability inventory: The agent authors bash scripts that can write to local environment files, manage GitHub secrets via the gh CLI, and open URLs in the user's browser (found in SKILL.md and template.sh).
Sanitization: The skill lacks explicit sanitization steps for content read from repository files before using it to generate executable logic.
[COMMAND_EXECUTION]: The skill is designed to produce and prepare bash scripts for execution. These scripts interact with the host system and external services.
Evidence: The template.sh file includes functions for modifying local .env files and using the GitHub CLI to set repository secrets. It also contains an example stage that directs the user to the Stripe dashboard to retrieve API keys.
[DYNAMIC_EXECUTION]: The skill generates and saves bash scripts from a local template to perform runtime tasks.
Evidence: The SKILL.md instructions guide the agent to copy template.sh and author custom stages into a new executable script.

wizard