The Agent Skills Directory

[SAFE]: The skill is designed for the legitimate purpose of managing TrueFoundry jobs and follows security best practices for deployment automation.
[EXTERNAL_DOWNLOADS]: Installs the official truefoundry CLI package from PyPI. This is a standard and expected dependency for a skill authored by the vendor to interact with their platform.
[COMMAND_EXECUTION]: Uses the tfy command-line tool and a provided helper script (tfy-api.sh) to communicate with the TrueFoundry API. The helper script is implemented with security in mind, using Bash arrays to safely pass arguments to curl.
[CREDENTIALS_UNSAFE]: Follows best practices by managing the TFY_API_KEY through environment variables or .env files rather than hardcoding. Instructions explicitly direct the agent to use secret references (tfy-secret://) and avoid printing raw sensitive values.
[INDIRECT_PROMPT_INJECTION]: Proactively mitigates risk by instructing the agent to avoid fetching and parsing data from external release pages (such as GitHub or HuggingFace releases), which could contain adversarial instructions aimed at altering agent behavior.

truefoundry-jobs