The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted metadata from external registries (such as descriptions and publisher claims) during MCP governance tasks.
Ingestion points: Registry metadata and package descriptions ingested in the 'MCP registry governance' and 'ASI06 Context & Memory Poisoning' sections of SKILL.md.
Boundary markers: The instructions advise the agent to treat this content as unverified, but do not specify technical delimiters or strict prompt boundaries for the ingested data.
Capability inventory: The skill uses execute_command, run_build, and write_file tools, which could be targeted by successful injection.
Sanitization: The skill mentions schema validation for tool invocations but lacks explicit sanitization for the natural language metadata read from registries.
[COMMAND_EXECUTION]: The skill uses execute_command and run_build to perform core functions such as artifact signing via Sigstore/cosign and SBOM generation. This level of access is appropriate for the skill's primary purpose of CI/CD pipeline hardening.
[EXTERNAL_DOWNLOADS]: Integrates well-known security tools and GitHub Actions from the CycloneDX and SLSA Framework repositories to generate software bill-of-materials and build provenance. These are recognized, reputable sources within the security industry.

supply-chain-security