The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where the agent reads and acts upon configuration files (.mise.toml or mise.toml). These files define external tools to be downloaded and executed. A malicious actor could provide a poisoned configuration file (e.g., via a Pull Request) to attempt to induce the agent to run unauthorized or malicious binaries.
Ingestion points: The agent is instructed to process .mise.toml and mise.toml files at the repository root.
Boundary markers: The skill identifies mise trust as a security requirement. However, the recommended automation for CI environments (./bin/mise trust && ./bin/mise install) programmatically grants trust, which could allow an untrusted configuration to be executed without manual verification.
Capability inventory: The skill grants the capability to perform network downloads (mise install), modify the filesystem (installation), and execute arbitrary commands (mise exec).
Sanitization: There are no instructions for the agent to validate or sanitize the versions or sources of the tools defined in the configuration files.
[DYNAMIC_EXECUTION]: The skill involves the generation and subsequent execution of a bootstrap script (bin/mise) using the mise generate install-script command. This script is intended to be committed to the repository to handle tool installation in CI environments like Xcode Cloud. This is a standard deployment practice for this toolset.
[COMMAND_EXECUTION]: The agent is guided to execute several shell commands related to environment management, including mise trust, mise install, mise exec, and mise generate. These represent the intended functional use of the mise utility.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of binary build tools and CLI utilities from external sources via the github:, gitlab:, and aqua: backends. These operations target release assets and official registries on well-known platforms.

mise-tool-management