The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs and executes shell commands using parameters retrieved from site-config.json. Specifically, fields like <aws.profile>, <client.email>, and <aws.domain> are interpolated directly into bash command strings (e.g., aws route53 list-hosted-zones-by-name --dns-name <aws.domain> --profile <aws.profile>). If an attacker modifies the configuration file to include shell metacharacters (e.g., ; rm -rf /), it could lead to arbitrary command execution on the host system.
[REMOTE_CODE_EXECUTION]: The skill executes local scripts (bootstrap.sh and validate-stack.sh) found within the path specified by the $TOOLKIT_DIR variable. This variable is read dynamically from the site-config.json file. While this is functional for the toolkit, it allows for the execution of arbitrary code if the configuration is pointed toward a malicious directory.
[DATA_EXFILTRATION]: The skill executes aws sts get-caller-identity, which retrieves and displays the AWS Account ID and IAM User ARN. While necessary for the preflight check to confirm credentials, users should be aware that this sensitive metadata is processed by the agent and recorded in the report.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from a configuration file and command-line arguments to drive its logic and shell operations.
Ingestion points: Reads site-config.json and $ARGUMENTS (SKILL.md, Steps 1 and 2).
Boundary markers: None observed; values are interpolated directly into instructions and commands.
Capability inventory: The skill has Bash access to the system and uses it to run AWS CLI tools and local scripts.
Sanitization: No evidence of input validation or escaping for configuration values before they are used in shell execution blocks.

website-preflight