The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes instructions and a logic block in references/prerequisites.md to automatically install the truefoundry CLI package (truefoundry==0.5.0) and its dependencies using pip or uv if the tool is missing from the environment.
[COMMAND_EXECUTION]: The skill executes shell commands via the tfy CLI and the tfy-api.sh script to manage infrastructure, perform deployments, and interact with TrueFoundry API endpoints. It also uses standard system tools like curl and pip for environment setup and network requests.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process configuration data for third-party Helm charts, which may be sourced from external registries or documentation services like Artifact Hub. This introduces a potential surface for indirect prompt injection through malicious chart metadata.
Ingestion points: Helm chart URLs, OCI registry paths, and configuration values (values.yaml) provided by users or retrieved from external sources.
Boundary markers: The skill contains explicit instructions for the agent to never auto-pick workspaces and to always seek user confirmation for chart sources, versions, and configurations before deployment.
Capability inventory: Manifest generation (file writing), network operations (API calls to TrueFoundry), and infrastructure deployment (command execution via tfy).
Sanitization: The tfy-api.sh script includes basic input validation to prevent path traversal in API requests. Additionally, the skill includes a specific security warning in references/container-versions.md instructing the agent not to fetch or parse content from external release pages.

truefoundry-helm