The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary user-provided shell commands on a remote server via SSH within a Docker container. This pattern allows for arbitrary code execution on the target machine.
[PRIVILEGE_ESCALATION]: The skill launches Docker containers using the --privileged flag and mounts sensitive host directories including /usr/local/sbin, /usr/local/Ascend/driver, and /etc/ascend_install.info. This configuration provides the container with extensive access to the host system hardware and administrative binaries, significantly increasing the impact of a potential container escape.
[PROMPT_INJECTION]: The skill implements logic to automatically identify missing dependencies by parsing the error output of executed test scripts and subsequently running pip install for those packages. This creates an indirect prompt injection surface where a malicious script can output crafted error messages to trick the agent into installing and executing arbitrary third-party packages.
[EXTERNAL_DOWNLOADS]: The skill automates the installation of packages from external repositories including Huawei Cloud, Tsinghua University, and Aliyun mirrors during the dependency resolution phase.
[DATA_EXFILTRATION]: The skill uses StrictHostKeyChecking=no for SSH connections, which bypasses host identity verification and makes the connection vulnerable to man-in-the-middle (MITM) attacks where credentials or data could be intercepted.
[CREDENTIALS_UNSAFE]: The skill writes execution reports to a hardcoded path in a specific user's home directory (/home/l00910600/report.txt) on the remote server, which may expose environment-specific metadata.

remote-npu-test