The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct the user to clone and install the core MCP server from an external GitHub repository (https://github.com/sibilleb/AAP-Enterprise-MCP-Server) that does not belong to the skill author or a recognized trusted organization.
[COMMAND_EXECUTION]: The skill provides the run_adhoc_command and run_job tools, which enable the agent to execute Ansible modules and playbooks directly on managed infrastructure. This represents a significant capability for command execution on remote hosts.
[REMOTE_CODE_EXECUTION]: Through the run_adhoc_command tool, the agent can trigger arbitrary module execution on remote target systems, which constitutes a form of remote code execution.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection attacks by processing data from the managed environment.
Ingestion points: The skill ingests potentially untrusted data via tools such as get_host_facts, job_logs, get_project_update_logs, and search_galaxy_collections (found in SKILL.md).
Boundary markers: There are no instructions or delimiters defined to prevent the agent from following commands that might be embedded in the retrieved logs or host facts.
Capability inventory: The skill possesses powerful write and execution capabilities, including run_job, run_adhoc_command, create_inventory, and create_project (SKILL.md).
Sanitization: There is no documented mechanism for sanitizing or escaping the data fetched from the AAP environment before it is used in the agent's context.

aap-automation