The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses ssh to execute commands on remote hosts frad-nas and 10.10.0.1 (the gateway) with high privileges, including root access. It performs administrative actions such as modifying system files, restarting Docker services, and running scripts within containers using docker exec and node -e.\n- [REMOTE_CODE_EXECUTION]: It implements a download-and-execute pattern where YAML configurations are fetched from a local SubStore API and then processed/validated using the mihomo binary inside a Docker container.\n- [CREDENTIALS_UNSAFE]: A hardcoded Xiaomi device token (000662ac87cd9dc57bc36b5a9816f917) is present in the instructions. Furthermore, the skill instructs the agent to search for and utilize other sensitive secrets, including the SubStore token and Clash API secret, found within configuration files.\n- [DATA_EXFILTRATION]: The skill reads sensitive configuration files (sub-store.json, config.json) containing authentication tokens and system topology details. These files are processed using ssh and curl, which can be leveraged to exfiltrate data to external servers.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and merges content from external subscription providers and third-party scripts without sanitization.\n
Ingestion points: sub-store.json, airport subscription endpoints (HXY, oixCloud), and scripts from jsdelivr.net.\n
Boundary markers: No delimiters or safety instructions are provided to ensure the agent ignores potentially malicious embedded instructions.\n
Capability inventory: High-impact capabilities including root ssh access, docker run, and dynamic script generation.\n
Sanitization: There is no evidence of validation or sanitization of external content before it is interpolated into sensitive configuration files or commands.

substore-openclash