The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted content from the local codebase to generate migration plans and configuration manifests.
Ingestion points: Project source code, configuration files (package.json, pyproject.toml), environment files (.env), and CI/CD yaml files are read via scripts/scan.sh and various search commands.
Boundary markers: No specific delimiters are used to encapsulate or neutralize potentially malicious instructions embedded within the analyzed project files.
Capability inventory: The skill possesses extensive capabilities including full filesystem read/write access (updating .env and .gitignore), network communication (via curl and vendor APIs), and shell command execution.
Sanitization: While the skill classifies call sites, it lacks formal sanitization or escaping mechanisms for the project data it processes before that data influences subsequent agent actions.
[DATA_EXFILTRATION]: The skill accesses sensitive local configuration to facilitate vendor integration.
Access to sensitive files: The preflight phase in SKILL.md reads the user's local TrueFoundry credentials from ~/.truefoundry/credentials.json to verify authentication status.
Credential Scanning: The scripts/scan.sh utility identifies hardcoded API keys (e.g., using sk- regex patterns) within the codebase to facilitate their migration to TrueFoundry Secrets.
Vendor Communication: Discovered configuration and model metadata are transmitted to the TrueFoundry API Gateway (gateway.truefoundry.ai) during the integration process. This behavior is consistent with the primary purpose of a vendor-authored integration tool.
[COMMAND_EXECUTION]: The skill utilizes several shell-based tools for code analysis.
Search tools: Extensive use of rg (ripgrep), grep, and find is employed to navigate the project structure.
Shell utilities: The scripts/scan.sh script uses the eval command to dynamically build and execute search queries based on exclusion patterns.
[DYNAMIC_EXECUTION]: The skill uses runtime interpreters for configuration parsing.
Python one-liners: SKILL.md uses python3 -c to parse JSON credential files and dependency manifests during the scanning process.

truefoundry-integrate-gateway