The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run and subprocess.Popen across multiple modules (fleet_manager.py, fleet_connect.py, fleet_remote.py, fleet_machines.py) to execute shell commands, manage Unix sockets, and interact with system binaries like ssh, tmux, and herdr.
[REMOTE_CODE_EXECUTION]: The core functionality of the skill is designed to execute arbitrary code and manage sessions on remote machines. This is achieved through SSH master connections and Herdr protocol panes, allowing the agent to steer remote processes and start new agent engines.
[PRIVILEGE_ESCALATION]: In fleet_connect.py, the skill attempts to use sudo -n for the non-interactive installation of the tmux dependency. While it includes logic to check for password-less sudo access and falls back to requesting human intervention, the attempt to escalate privileges for environment setup is a significant capability.
[DATA_EXFILTRATION]: The fetch command in fleet_remote.py enables the retrieval of arbitrary files from remote machines to the local filesystem. This capability allows for the access and transfer of potentially sensitive data from managed hosts to the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests and processes untrusted data from remote machines, including terminal screen captures, session titles, and dialog text.
Ingestion points: fleet_tmux.capture, fleet_remote.run_herdr (pane reading), and fleet_remote.fetch (file content).
Boundary markers: The skill lacks explicit boundary markers or "ignore" instructions when presenting remote session output or dialog text to the agent.
Capability inventory: The skill possesses high-privilege capabilities including arbitrary command execution (subprocess), remote access (ssh), and local file writing.
Sanitization: While the skill uses shlex.quote for outgoing commands and collapses whitespace in output for display, it does not perform security-focused sanitization of the content read from remote sessions.

fleet-manager