The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill technical implementation in SKILL.md is vulnerable to command injection. User-provided arguments for NPU count and product type are interpolated directly into a shell execution string: bash /tmp/envCheck.sh <args>. An attacker could provide malicious input containing shell metacharacters (e.g., ;, |, &) to execute arbitrary commands on the target host when the agent processes the request.- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires the user to provide highly sensitive credentials, including the SSH password and the path to the user's private SSH key (e.g., ~/.ssh/id_rsa). The implementation uses sshpass -p, which can leak passwords to other processes on the local system via process listing utilities. Furthermore, instructing an agent to access private keys from the filesystem poses a significant data exposure risk if the agent's environment is compromised.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection. 1. Ingestion points: The envCheck.sh script retrieves cluster metadata, node labels, and ConfigMap content via kubectl from potentially untrusted nodes. 2. Boundary markers: The instructions do not specify any delimiters or safety markers to isolate this untrusted data when it is presented to the agent for summarization. 3. Capability inventory: The skill has remote shell execution capabilities via SSH. 4. Sanitization: No sanitization is performed on the cluster data before it is interpolated into the agent's context, allowing a malicious cluster state to influence agent behavior through injected instructions.- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill's primary function is the execution of a shell script (envCheck.sh) on a remote Kubernetes master node. While this is the intended purpose, the combination of user-controlled arguments and high-privilege access (often as root) creates a dangerous remote execution vector.

ascend-envcheck