The Agent Skills Directory

[DATA_EXFILTRATION]: The skill facilitates access to sensitive file paths on the Home Assistant host, including /root/config/secrets.yaml and SSH private keys such as ~/.ssh/id_rsa and ~/.ssh/id_ed25519. Although the documentation warns against exposing values, granting the agent the capability to read these files creates a significant risk of sensitive data exposure.
[COMMAND_EXECUTION]: The provided SSH command includes -o StrictHostKeyChecking=no, which disables host key verification and exposes the connection to Man-in-the-Middle (MITM) attacks. The skill also encourages executing high-privilege system commands (docker ps, ha core restart, journalctl) on the host system as the root user.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a surface for indirect prompt injection by instructing the agent to read and process external, untrusted data such as system journal logs and Home Assistant core logs.
Ingestion points: Host-level log files and Home Assistant configuration files.
Boundary markers: No delimiters or instructions are provided to the agent to distinguish between external log data and its own system instructions.
Capability inventory: Full shell access via SSH, allowing for file reads, writes, and execution of system-level binaries.
Sanitization: No sanitization or validation of the ingested log or config content is described.

ez-ssh