The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute arbitrary shell commands on remote hosts using callCommand and submitJob. This includes support for login shells that source remote initialization scripts such as .bashrc.
[INDIRECT_PROMPT_INJECTION]: The agent is explicitly instructed to read and follow "operation instructions" stored in the doc field of host metadata, which is persistent across sessions and can be updated by the agent. This creates a surface where instructions from one task could influence subsequent tasks.
[INDIRECT_PROMPT_INJECTION]: Ingestion points: The doc field in host.compute.details and remote job outputs (stdout, stderr).
[INDIRECT_PROMPT_INJECTION]: Boundary markers: The skill instructions do not specify boundary markers or explicit warnings to ignore embedded instructions within the host metadata.
[INDIRECT_PROMPT_INJECTION]: Capability inventory: The skill has high-tier capabilities including shell command execution, background job submission, file harvesting, and artifact publishing.
[INDIRECT_PROMPT_INJECTION]: Sanitization: No sanitization or validation is mentioned for the content read from host metadata or remote command outputs.
[DATA_EXFILTRATION]: The skill facilitates the transfer of data between remote hosts and the local agent environment (harvesting), as well as publishing data to an external artifact server via the write_artifact_file tool.

remote-compute-ssh