The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The documentation contains hardcoded default credentials in example curl commands for obtaining tokens (username=admin, password=admin) and setting temporary user passwords (temp_password_123). While these are presented as local development defaults, they represent hardcoded secrets in the instruction set.
[COMMAND_EXECUTION]: The skill involves executing host-level commands, specifically docker cp and docker restart, to manage identity provider services and deploy custom themes, which requires elevated environment permissions.
[PROMPT_INJECTION]: The skill facilitates the ingestion of user-controlled data into administrative API requests, creating a surface for indirect prompt injection. 1. Ingestion points: Fields from req.body (email, firstName, lastName, orgId) in the user-service controller are used to construct user objects. 2. Boundary markers (absent): No delimiters or instructions to ignore embedded commands are present in the interpolation logic. 3. Capability inventory: Comprehensive identity management including user creation, role assignment, and realm configuration via axios and curl. 4. Sanitization (absent): No input validation or sanitization logic is evidenced in the provided skill scripts.

keycloak-admin