The Agent Skills Directory

[SAFE]: The skill facilitates management of roles, teams, and collaborators on the TrueFoundry platform. It uses a dedicated Bash script, tfy-api.sh, as an authenticated wrapper for API calls.
[SAFE]: No hardcoded credentials or secrets were detected. The skill correctly utilizes environment variables (TFY_API_KEY, TFY_BASE_URL) for authentication and configuration.
[SAFE]: The skill includes instructions to automatically install the official truefoundry CLI package if missing. This is a standard vendor-provided dependency installation.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external API responses and performs privileged access control modifications.
Ingestion points: Data retrieved from TrueFoundry API endpoints (roles, teams, and collaborator lists) and user-provided subjects/identifiers.
Boundary markers: The skill utilizes structured JSON for API payloads.
Capability inventory: Comprehensive management of IAM entities (roles, teams, collaborators) via curl-based operations in tfy-api.sh.
Sanitization: The tfy-api.sh script validates the API path to prevent path traversal attacks and the instructions explicitly warn the agent to confirm identity and permissions with the user before performing privileged operations.
[SAFE]: The skill includes explicit security warnings to the agent regarding third-party content and instructions to avoid ingesting content from external release pages to prevent indirect prompt injection.

truefoundry-access-control