The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local shell commands to perform its primary function of stack initialization. This includes creating directories, copying template files from the plugin root using rsync and cp, validating Docker Compose configurations, and starting containers. These actions are within the intended scope of a 'stack-init' utility.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged health check commands as potential remote code execution. Manual review confirms these are false positives: the commands (e.g., curl ... | python3 -c '...') use python3 to execute a hardcoded, static string for parsing JSON data from the local Prometheus/Alertmanager APIs. No scripts are downloaded or executed from the network.
[INDIRECT_PROMPT_INJECTION]: The skill implements a configuration 'overlay' mechanism that reads instructions and files from an environment-defined path ($POWERSUIT_OVERLAY).
Ingestion points: Reads README.md and configuration files from the $POWERSUIT_OVERLAY/observability/ directory (SKILL.md).
Boundary markers: None present; the skill instructions explicitly direct the agent to 'follow the overlay' if it conflicts with default instructions.
Capability inventory: The skill can write files, execute shell commands, and manage Docker containers via the host system.
Sanitization: No specific sanitization is mentioned for the overlay content, but the mechanism is presented as a standard extension feature for the agent environment.
[CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by explicitly forbidding the writing of secrets into chat or version-controlled files. It directs users to manually populate a .env file and ensures that both the environment file and Alertmanager secret directories are added to .gitignore.

stack-init