The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands on a remote host using SSH. It constructs these commands by interpolating variables such as <id> and <host> directly into a shell string: ssh ... <host> 'cd /root/queue && node ./debug-failed-job.js --run <id>'. This pattern is highly susceptible to command injection; if an attacker can influence the flow run ID (for example, by triggering a failing job with a malicious name/ID), they could execute arbitrary commands on the target DevOps server.
[CREDENTIALS_UNSAFE]: The instructions direct the agent to retrieve the remote host address by reading the user's local SSH configuration file (~/.ssh/config). Accessing this file exposes sensitive infrastructure metadata, connection aliases, and potential security configurations to the agent.
[PROMPT_INJECTION]: The skill possesses a significant indirect prompt injection surface as it ingests untrusted data from remote job reports and ClickHouse logs.
Ingestion points: Standard output from SSH commands (JSON reports) and body/attribute fields from ClickHouse logs (SKILL.md).
Boundary markers: Absent. The skill provides no instructions for the agent to use delimiters or to ignore potential instructions embedded within the job stack traces or log messages.
Capability inventory: The agent is granted capabilities for remote shell execution (SSH), SQL execution via the ClickStack MCP, and local file system access through Grep.
Sanitization: None. The skill explicitly tells the agent to quote raw failure reasons and log bodies, which may contain malicious instructions designed to hijack the agent's behavior.
[DATA_EXFILTRATION]: The skill operates within highly privileged directories (e.g., /root/queue) on a remote DevOps box and reads from centralized databases (Postgres, ClickHouse) that likely contain sensitive operational data, secrets, or user information. This data is extracted and reported back to the agent's context.

debug-failed-run