The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell scripts (tfy-api.sh, tfy-version.sh) and CLI tools to interact with the TrueFoundry platform. These scripts handle authentication via environment variables and perform network requests using curl to manage resources.
[EXTERNAL_DOWNLOADS]: The skill provides instructions and a bash snippet to automatically install the truefoundry package and dependencies like pydantic from standard package registries (PyPI) using pip or uv if they are missing from the environment.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it ingests and processes data from external API endpoints (e.g., listing secret groups, fetching deployment status). While the skill contains explicit warnings for the agent to avoid fetching third-party content from URLs like GitHub or HuggingFace release pages, the interaction with dynamic API data is a standard risk for such integrations.
[DATA_EXPOSURE]: The skill is centered around the management of sensitive credentials. It employs several defensive strategies, such as instructing the agent to never log or display full secret values and advising users to pass credentials through environment variables rather than inline shell arguments to avoid exposure in process lists or shell history.

truefoundry-secrets