The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes raw output from network devices (e.g., show version), which represents a surface for indirect prompt injection. An attacker with control over a network device could potentially craft a malicious version string or system banner designed to influence the agent's logic or behavior.
Ingestion points: The version parameter in the check_version and check_versions tools accepts full show version command output directly from untrusted devices.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the device output as data only and ignore any embedded instructions.
Capability inventory: The skill facilitates the execution of Python scripts via subprocess calls and makes network requests to external APIs.
Sanitization: While the documentation states that the server normalizes the version strings, the specific validation logic is handled by external scripts not visible for analysis.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using environment variables (e.g., $MCP_CALL, $CISCO_PSIRT_MCP_SCRIPT) to define the script paths and execution wrappers. This is a form of dynamic execution where the integrity of the operation depends on the secure configuration of the environment variables.

cisco-psirt-advisories