The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the agent with a wide array of bash commands to execute on the host system to gather audit data. This includes process monitoring (ps), file searching (find), and log analysis (grep, tail).
[DATA_EXFILTRATION]: The skill instructions require the agent to access and read highly sensitive system files that contain authentication and authorization secrets.
Evidence: Commands in SKILL.md attempt to read /etc/shadow, /etc/sudoers, and the root directory's .ssh/authorized_keys file.
Context: These operations are central to the primary purpose of security auditing, which justifies the access, but the presence of raw cryptographic keys and hashed passwords in the agent's context increases the risk of accidental exposure or exfiltration if the output is not properly masked.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various system sources that an attacker could control to influence the agent's reasoning or output.
Ingestion points: The agent reads system logs (/var/log/secure, /var/log/auth.log), user-defined crontabs, and external web application files within /www/wwwroot (identified in SKILL.md).
Boundary markers: The prompt lacks explicit technical delimiters or boundary markers to encapsulate raw data from command outputs, increasing the risk that the AI will follow instructions embedded within logs or files.
Capability inventory: The skill possesses extensive filesystem read access and the ability to execute arbitrary shell commands via the agent's tooling.
Sanitization: While the instructions mention manual data masking ("脱敏"), there is no programmatic sanitization or filtering applied to the raw system data before it is ingested into the agent's context.

bt-security-audit