The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to read repository files such as README, .env, and GitHub workflow files to scope the configuration wizard. This creates a surface for indirect prompt injection, where malicious instructions in these files could influence the agent to generate a bash script that performs unintended actions.
Ingestion points: The agent reads .env, .env.example, README, and .github/workflows/* to determine the necessary stages and variables (documented in SKILL.md).
Boundary markers: There are no instructions to use delimiters or ignore embedded commands when processing these untrusted repository files.
Capability inventory: The generated script can write to local files (write_env), set GitHub secrets via the gh CLI (set_secret), and open URLs (open_url) using the functions in template.sh.
Sanitization: No sanitization logic is provided to filter data extracted from the repository before it is interpolated into the generated shell script.
[DYNAMIC_EXECUTION]: The skill uses a template to generate a bash script that is intended for execution by the human user. The logic and variable names within the script are dynamically generated based on the agent's interpretation of untrusted repository content. This process could lead to the generation of a script that executes unintended shell commands if the agent is manipulated by project metadata.

wizard