The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external billing sources (invoices, statements) and SSO exports which may contain attacker-controlled content.
Ingestion points: Untrusted data enters the agent context in Steps 2 and 3 during the collection of billing sources and SSO app lists.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing external vendor names or contract terms.
Capability inventory: The skill can execute shell commands (mkdir, rsync, cp) and a local Python script.
Sanitization: There are no explicit sanitization or filtering steps mentioned for the content extracted from billing or contract documents before it is written to the inventory report.
[COMMAND_EXECUTION]: The skill executes local shell commands to manage files and templates, and it runs a repository-internal script.
Evidence: Step 1 uses mkdir, rsync, and cp. Step 9 executes python3 .github/actions/gate/run.py --only finops.cost-provenance --dry-run to validate data.
[DYNAMIC_EXECUTION]: The skill contains logic to load additional instructions from a dynamic path determined by an environment variable.
Evidence: The 'Overlay' section checks the $POWERSUIT_OVERLAY environment variable and reads a README.md and other files from that path to override default skill behavior.

saas-stack-audit