The Agent Skills Directory

[COMMAND_EXECUTION]: The skill manages remote appliances by executing shell commands via SSH. This includes discovery (jq, docker ps), diagnostics (docker inspect), and configuration updates. These operations are fundamental to the skill's system administration purpose and are performed within a user-authorized SSH session.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the target host, creating an injection surface where an attacker with control over the host's container metadata or registry files could attempt to influence agent behavior.
Ingestion points: Data is ingested from the /etc/casaos/app-management.json registry file and container labels extracted via docker inspect (e.g., in scripts/diag-app.sh).
Boundary markers: Untrusted data is not wrapped in explicit delimiters to isolate it from the agent's instructions.
Capability inventory: The agent has capabilities for shell execution (via SSH), file read/write, and container management.
Sanitization: The skill uses jq for structural JSON parsing, which provides a layer of data validation, though specific text field content is not sanitized for LLM-level instructions.
[EXTERNAL_DOWNLOADS]: The skill documentation and recipes reference downloads from well-known and trusted sources, such as GitHub and Cloudflare, for installation and data fetching. These operations are standard for development and administration workflows and do not involve untrusted remote code execution.

casaos-ssh