The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the doctl binary from DigitalOcean's official GitHub repository. This is a legitimate download from a well-known service provider.
[COMMAND_EXECUTION]: The skill uses various shell commands, including doctl and ssh, to manage cloud resources and verify connectivity.
[DATA_EXFILTRATION]: The skill accesses sensitive local files, specifically the SSH private key at ~/.ssh/id_rsa, and instructs the user to provide a DigitalOcean API token. This data exposure is required for the skill's intended infrastructure management functionality.
[PRIVILEGE_ESCALATION]: The skill uses sudo commands during the installation process to move the doctl binary to a system path and to install packages via snap.
[INDIRECT_PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection as it ingests untrusted user input for parameters like SERVER_NAME and DO_REGION which are then interpolated into shell commands.
Ingestion points: Variables such as SERVER_NAME, DO_REGION, DO_SIZE, SSH_KEY_NAME, and SSH_KEY_PATH are collected from user input in SKILL.md.
Boundary markers: None are present to delimit or warn the agent about potentially malicious instructions embedded in user-supplied strings.
Capability inventory: The skill possesses extensive capabilities including file system access, network operations via the DigitalOcean API, and remote command execution through SSH (documented in SKILL.md).
Sanitization: There is no evidence of input validation, escaping, or sanitization for user-provided variables before they are used in command-line operations.

digital-ocean