The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill contains logic in references/prerequisites.md to automatically install the truefoundry CLI via pip or uv if it is not detected. While it targets a pinned version (0.5.0) from the official registry (PyPI), the instructions explicitly direct the agent to perform this installation autonomously without asking the user for confirmation.
[COMMAND_EXECUTION]: The skill relies on executing shell commands via the tfy CLI and a custom authenticated wrapper script (tfy-api.sh) to perform deployments, resource management, and authenticated API calls to the TrueFoundry platform.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it interpolates user-supplied data (such as workflow names, parameters, schedules, and logic) into generated Python workflow definitions and YAML deployment manifests. These generated files are then executed by the TrueFoundry platform.
Ingestion points: User-provided configurations for workflow names, task logic, resource requirements, and cron schedules in SKILL.md and references/manifest-defaults.md.
Boundary markers: Uses markdown code blocks and ${VARIABLE} placeholders to delimit generated content.
Capability inventory: Includes shell command execution (Bash), file system writes (writing Python scripts and YAML manifests), package installation (pip), and authenticated network requests (curl via the tfy-api.sh wrapper).
Sanitization: The skill does not include explicit logic or instructions for the agent to sanitize or validate user-provided strings before interpolation into executable scripts or manifests.

truefoundry-workflows