The Agent Skills Directory

[SAFE]: The skill follows security best practices by recommending the use of TrueFoundry's internal secret store (via tfy-secret:// URIs) instead of hardcoding sensitive credentials in deployment manifests.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official truefoundry Python package from PyPI. This is a trusted vendor dependency used for its CLI and SDK functionality.
[COMMAND_EXECUTION]: Bash scripts and the tfy CLI are used to orchestrate deployments, verify environment health, and check for existing manifests. These operations are limited to the intended administrative tasks and do not involve executing untrusted remote code.
[SAFE]: Internal utility scripts such as tfy-api.sh and tfy-version.sh are transparent bash scripts that include basic security checks, such as preventing path traversal in API paths and using a safe parser for .env files rather than sourcing them directly.
[PROMPT_INJECTION]: While the skill ingests local project data (e.g., docker-compose.yml, Dockerfile), it provides explicit safety instructions in references/container-versions.md forbidding the agent from fetching or ingesting content from third-party release pages, effectively mitigating indirect prompt injection risks from external sources.

deploy