The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses localized bash scripts (scripts/tfy-api.sh and scripts/tfy-version.sh) to interact with the TrueFoundry API and detect environment versions. The API helper script includes validation logic to restrict HTTP methods and prevent path traversal attacks by ensuring the API path starts with a slash and does not contain parent directory references.
[DATA_EXFILTRATION]: While the skill's primary purpose is log retrieval, which involves handling potentially sensitive data (PII, tokens, secrets), it includes explicit security warnings. These instructions advise the agent to review content for sensitivity and prioritize summarization over raw data output to mitigate data exposure risks.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of the official truefoundry Python package and references container images from the vendor's public registries (AWS ECR, JFrog). These are verified vendor resources required for standard operation and do not pose a supply chain risk in this context.
[INDIRECT_PROMPT_INJECTION]: By ingestsing application logs which are externally controlled data, the skill possesses an indirect prompt injection surface. This risk is acknowledged and addressed in the instructions, which guide the agent to identify error patterns and summarize behavior rather than following instructions that might be embedded in the log streams.

truefoundry-logs