The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local project metadata to determine configuration requirements, creating a surface where malicious project files could influence generated output.
Ingestion points: Reads from project files including package.json (via npm pkg get), requirements.txt, pyproject.toml, and setup.py as seen in SKILL.md.
Boundary markers: The skill does not provide explicit delimiters or instructions to ignore embedded instructions when reading these files.
Capability inventory: The skill utilizes shell commands for environment detection (ls, npm) and configuration validation (brew, actionlint, npx).
Sanitization: No explicit sanitization or strict schema validation is described for the content extracted from project files before it is interpolated into generated CI/CD YAML templates.
[COMMAND_EXECUTION]: The skill uses various shell commands to inspect the local development environment and validate generated configuration files.
Examples include directory listing (ls), package metadata extraction (npm pkg get), and the use of validation tools like actionlint, circleci, and yaml-lint. These are standard, task-appropriate tools for CI/CD development.

building-cicd-configs