The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the execution of multiple shell scripts to manage the development stack.
Evidence: chmod +x run.sh, ./run.sh up, ./run.sh tui, and ./run.sh rehearsal in SKILL.md.
The run.sh script is responsible for executing upstream demo scripts such as prepare-devnet.sh and seed-devnet.sh.
[PRIVILEGE_ESCALATION]: The instructions suggest using root privileges within a Docker container to resolve file permission issues.
Evidence: docker compose exec -u root cardano-node chmod a+w /devnet/node.socket in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill fetches external code and resources from public repositories and container registries.
Evidence: Clones the cardano-scaling/hydra repository from GitHub and pulls images from ghcr.io/cardano-scaling/hydra-node.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where instructions could be embedded in external data processed by the agent.
Ingestion points: The agent is instructed to read container logs (docker compose logs) and check health endpoints (http://localhost:1442, http://localhost:4001-4003).
Boundary markers: None specified to differentiate between standard log output and potential malicious instructions.
Capability inventory: The skill can execute shell commands (bash), modify file permissions (chmod), and manage Docker containers.
Sanitization: No evidence of output sanitization or validation of the log content before the agent processes it.

cardano-devnet-in-a-box