The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes functionality to download and install new AI agent skills from remote OCI artifact repositories via the flux-operator skills install command. This allows for the dynamic extension of the agent's instruction set from external sources.
[DATA_EXFILTRATION]: The skill documentation describes access to sensitive local files for cluster authentication and GitOps synchronization, specifically targeting ~/.kube/config, SSH private keys (~/.ssh/id_ed25519), and SOPS/Age encryption keys (age.key, private-key.pem).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect prompt injection as it is designed to ingest and process YAML manifests from remote and potentially untrusted URLs (e.g., flux-operator diff yaml, flux-operator install -f).
Ingestion points: Manifest files loaded from GitHub, GitLab, or OCI URLs during diff, build, or installation operations.
Capability inventory: The skill allows full cluster lifecycle management, secret creation, and dynamic skill installation.
Boundary markers: No specific delimiters or warnings for the agent to ignore instructions embedded in manifests are documented.
Sanitization: The instructions do not specify validation or sanitization steps for remote manifest content before execution or processing.
[COMMAND_EXECUTION]: The agent is granted administrative control over Kubernetes clusters, including installing/uninstalling operators, modifying system-level resources, and managing reconciliation logic.
[CREDENTIALS_UNSAFE]: The documentation provides examples of creating Kubernetes secrets by passing credentials (passwords, tokens, and SSH keys) directly through command-line flags, which can expose sensitive information in shell history or process listings.

flux-operator-cli