The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file test/playbooks/bad-playbook.yml contains a hardcoded password hardcoded_password_123. While intended as a test case for the validator, it represents a hardcoded credential finding.
[PRIVILEGE_ESCALATION]: The test/playbooks/bad-playbook.yml file includes a task that sets file permissions to 0777 (world-writable). Although this is a test fixture for the scanner, it is a privilege escalation vulnerability pattern.
[EXTERNAL_DOWNLOADS]: Multiple scripts in the scripts/ directory (setup_tools.sh, test_role.sh, validate_playbook.sh, validate_role.sh, validate_inventory.sh, validate_playbook_security.sh, validate_role_security.sh) facilitate the download and installation of Python packages from the official Python Package Index (PyPI). These include ansible, ansible-core, ansible-lint, yamllint, checkov, molecule, molecule-docker, molecule-podman, and pyyaml. These are well-known development tools and are documented as part of the skill's bootstrap process.
[COMMAND_EXECUTION]: The skill's default behavior involves automatically attempting to execute molecule test on any Ansible role that contains a molecule/ directory. This results in the execution of the Ansible code within the role, which constitutes command execution on the host or in containers.
[DYNAMIC_EXECUTION]: Several validation scripts (validate_playbook.sh, validate_role.sh, test_role.sh, etc.) dynamically create temporary Python virtual environments and install executable tools at runtime if they are not detected on the system.
[INDIRECT_PROMPT_INJECTION]: The skill serves as an ingestion surface for external, untrusted Ansible playbooks, roles, and inventory files. Since it has capabilities for code execution (via Molecule) and subprocess calls (via Ansible CLI), a malicious file could potentially trigger unintended actions during the validation process.
Ingestion points: Playbooks, roles, and inventory files processed by the scripts.
Boundary markers: The skill relies on standard Ansible delimiters but does not implement specific sanitization to prevent the agent from obeying instructions embedded within the data files.
Capability inventory: Extensive use of subprocess calls to execute ansible-playbook, molecule, ansible-lint, and checkov.

ansible-validator