The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to execute build commands (e.g., pnpm build, bun run build) and Docker commands using the local repository as context. This creates a surface for indirect prompt injection where a malicious repository could influence the agent's behavior via build scripts or .tape files. \n
Ingestion points: Repository build configuration and .tape files described in SKILL.md.\n
Boundary markers: No explicit instructions to ignore embedded instructions are present.\n
Capability inventory: Uses the Bash tool to perform builds and run Docker containers with filesystem mounts.\n
Sanitization: No validation or sanitization of repository-provided content is performed before execution.\n- [REMOTE_CODE_EXECUTION]: The templates/vhs.Dockerfile includes a command to fetch and execute an installation script from https://bun.sh/install. Although this is the official installation method for a well-known technology, piped execution from a remote source is a high-privilege pattern.\n- [COMMAND_EXECUTION]: The skill's primary operation involves executing shell commands to build projects and run Docker containers (docker run --rm -v "$PWD:/vhs"), which are powerful operations dependent on the security of the target repository.

vhs-demo