The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently uses shell command templates to invoke functionality (e.g., python3 $MCP_CALL "python3 -u $CATC_MCP_SCRIPT" TOOL_NAME 'ARGS_JSON'). If the agent populates 'ARGS_JSON' or tool names with unsanitized data from external sources (like device hostnames), it could lead to command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from Catalyst Center and pyATS, including device hostnames, interface descriptions, and CLI log messages. This data constitutes an attack surface for indirect prompt injection if an attacker controls a network device.
Ingestion points: Untrusted data is retrieved from network devices via tools like fetch_devices, fetch_interfaces, pyats_run_show_command, and pyats_show_logging (SKILL.md).
Boundary markers: Absent; there are no instructions or delimiters defined to help the agent distinguish between its instructions and potentially malicious content within the device data.
Capability inventory: The skill allows the agent to execute local Python scripts, perform network connectivity tests (pings), and read extensive configuration data from network controllers.
Sanitization: No sanitization, filtering, or validation steps for the external data are described in the instructions.
[CREDENTIALS_UNSAFE]: Command examples include passing sensitive credentials as environment variables directly in the shell execution string (e.g., CCC_PWD=$CCC_PWD). While standard for many automation environments, this can expose credentials to process-monitoring tools on the host system.

catc-troubleshoot