The Agent Skills Directory

[COMMAND_EXECUTION]: The splunk_search helper function in SKILL.md is vulnerable to shell command injection. The variable ${spl} is interpolated directly into a shell command that executes python3 -c without proper escaping. If a search query contains shell metacharacters such as backticks or $(), the shell will execute those commands on the host machine.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Splunk logs and search results, which can be manipulated by attackers to influence agent behavior.
Ingestion points: Data returned by the splunk_api and splunk_search functions in SKILL.md.
Boundary markers: Absent. The skill instructions do not specify any delimiters or warnings to differentiate between system instructions and log content.
Capability inventory: The skill possesses the ability to perform network operations via curl and execute local code via python3.
Sanitization: Absent. Results are parsed by jq but the raw text content of logs is not sanitized or filtered before being presented to the agent.
[DYNAMIC_EXECUTION]: The skill uses python3 -c for runtime utility tasks (URL encoding). This pattern creates a dynamic execution surface that, when combined with the lack of input sanitization in the shell script, allows for potential code injection.

monitoring-splunk