The Agent Skills Directory

[COMMAND_EXECUTION]: The skill enables the agent to perform destructive system operations, such as terminating processes via kill -9 <PID>. While instructions require user confirmation, this capability allows for significant system interference.
[PRIVILEGE_ESCALATION]: Deployment templates frequently use the --privileged flag for Docker containers. This grants the container nearly full access to the host NPU devices and kernel features, effectively bypassing standard container isolation boundaries.
[CREDENTIALS_UNSAFE]: The documentation and templates (e.g., in references/launch-templates/docker.md) explicitly demonstrate the use of sshpass -p 'password'. This is a highly insecure practice that exposes credentials in shell history, process listings, and scripts.
[REMOTE_CODE_EXECUTION]: The skill consistently configures the vllm serve command with the --trust-remote-code flag. When combined with the model discovery feature that searches broad system paths, this creates a risk of executing arbitrary code embedded in maliciously crafted model repositories.
[INDIRECT_PROMPT_INJECTION]: The skill automates logic based on the contents of external files found on the system.
Ingestion points: Reads config.json and quant_model_description.json from various search paths like /home/weights and /data* to determine deployment parameters.
Boundary markers: None identified; the agent is instructed to trust the contents of these files for logic branching.
Capability inventory: Significant capabilities including shell command execution (vllm serve), process termination (kill), and container management (docker run).
Sanitization: No validation or sanitization of the values read from the JSON files is specified before they are interpolated into shell commands.

vllm-ascend-server