The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill interacts with the TrueFoundry REST API and processes its output, creating a potential surface for indirect prompt injection if API responses were to contain adversarial content. Additionally, the manifest schemas described in the references allow for external URLs (e.g., OpenAPI specs or Agent cards) to be registered and fetched by the platform.
Ingestion Point: API response data returned by scripts/tfy-api.sh and external manifest URLs.
Boundary Markers: The skill does not implement specific delimiters for external data in its tool output instructions.
Capability Inventory: The agent can perform sensitive actions such as creating or deleting personal access tokens.
Sanitization: The instructions include strict policies for masking tokens and preventing the storage or re-display of sensitive values.
[COMMAND_EXECUTION]: The skill utilizes a bash script (scripts/tfy-api.sh) to execute authenticated curl requests. The script contains safeguards against path traversal (..) and limits permitted HTTP methods to a whitelist.
[EXTERNAL_DOWNLOADS]: The skill contains logic in references/prerequisites.md to automatically install the truefoundry package and pydantic from standard registries if they are missing from the environment. These are vendor-provided resources.

truefoundry-access-tokens