The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a vulnerability surface for indirect prompt injection attacks by combining data ingestion with high-impact capabilities.
Ingestion points: The agent retrieves untrusted data (VM names, status, and configurations) from the external Proxmox environment using tools like get_vms, get_vm_status, and get_vm_config defined in SKILL.md.
Boundary markers: The skill lacks instructions for the agent to use delimiters or ignore potential instructions embedded within the retrieved VM metadata.
Capability inventory: The skill grants the agent high-impact administrative capabilities, such as delete_vm (which includes data removal), stop_vm, and update_vm_config.
Sanitization: No sanitization or validation requirements are specified for the infrastructure data before it is incorporated into the agent's context.
[METADATA_POISONING]: The skill-report.json file contains deceptive metadata, including a simulated future generation date (2026) and references to a non-existent "gpt-5.5" model. This misleading information could misrepresent the skill's provenance or the validity of its internal audit report.
[NO_CODE]: The provided skill files (SKILL.md, skill-report.json) do not contain any executable scripts, binaries, or source code. The skill is entirely descriptive, directing the agent's use of external tools.
[SAFE]: The findings of "shell backtick execution" highlighted in the skill's own audit report (skill-report.json) are verified as false positives. These instances are standard Markdown backticks used for formatting tool names in SKILL.md and do not represent a command injection risk.

virtual-machine-management