The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content, creating a surface for indirect prompt injection attacks. Besides the analysis scripts, the agent is instructed to perform decision-making based on these potentially compromised inputs.
Ingestion points: The scripts/analyze-repo.sh script reads manifest files (such as package.json, requirements.txt, and composer.json) and up to 100 source code files from the repository being analyzed to detect runtime configurations.
Boundary markers: Data extracted from these untrusted files is returned to the agent in a JSON object. There are no clear boundary markers or instructions telling the agent to treat these specific values as untrusted content.
Capability inventory: The skill possesses the capability to execute shell commands, clone Git repositories, and perform network operations through the ve CLI.
Sanitization: No sanitization, escaping, or validation logic is applied to the data read from the repository files before it is passed to the agent's context.
[COMMAND_EXECUTION]: The skill executes local shell scripts (scripts/analyze-repo.sh and scripts/check-region-services.sh) and system utilities including git, find, grep, and the ve (Volcengine) CLI to perform project analysis and cloud service probing.
[EXTERNAL_DOWNLOADS]: The skill invokes git clone to download repository content from external URLs provided by the user into a temporary cache directory (/tmp/volcengine-prepare/) for analysis.

volcengine-prepare