The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data, such as system logs, error messages, and resource states (e.g., '403', 'connection rejected', 'state is locked'). This creates an attack surface where a malicious actor could provide crafted input that tricks the agent into initiating a 'recovery' process that actually compromises the system.
Ingestion points: The skill analyzes user-provided error logs, credential status messages, and resource metadata (found in SKILL.md under 'When To Use').
Boundary markers: The skill includes instructions to 'refuse requests to remove safety controls' and requires 'explicit confirmation before taking a live action,' which helps mitigate accidental obedience but does not fully prevent sophisticated adversarial injection.
Capability inventory: The instructions permit the agent to perform key rotation, certificate renewal, RBAC adjustments, and state unlocking using the session's toolset.
Sanitization: No explicit input sanitization or verification of the source of the 'recovery path' is defined within the skill instructions.
[COMMAND_EXECUTION]: The skill guides the agent to perform administrative actions such as 'key rotation', 'certificate renewal', and 'RBAC adjustment'. These procedures involve executing sensitive commands or API calls to modify the environment's security configuration. While the instructions mandate using 'authorized channels,' the skill essentially empowers the agent to act as a privileged administrator.

knock