The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes a standalone Node.js script scripts/install-asg-cli.js which downloads the asg CLI binary and its associated checksum file from the official wso2/wso2-cli GitHub repository. The script follows secure practices by verifying the SHA-256 hash of the downloaded binary before installation.
[REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of an external binary (asg CLI). As per security rules, this is considered safe as the source is the official repository of the skill's author (WSO2) and the download process includes integrity checks.
[COMMAND_EXECUTION]: The skill's primary function is to execute shell commands via the asg CLI to manage identity resources. The installation script also uses system commands to update the system PATH on Linux, macOS, and Windows (via PowerShell).
[PERSISTENCE]: The install-asg-cli.js script modifies shell profile files (such as .bashrc, .zshrc, and config.fish) and Windows User Environment variables to ensure the CLI remains accessible in the system PATH across sessions. This is standard behavior for a CLI installer.
[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to fetch external markdown documentation from the vendor's official website (wso2.com) and ingest it into the agent context to assist with SDK integration and API usage. This introduces a surface for indirect prompt injection, although the risk is minimized by the use of trusted vendor sources.

asgardeo