The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides explicit instructions for downloading sensitive files from the remote host, such as SSH keys (~/.ssh/*), environment configurations (.env), and git settings (.gitconfig). It mentions that these paths trigger a hardened per-file confirmation modal, positioning the tool as a legitimate method for retrieving sensitive data.
[DATA_EXFILTRATION]: The skill performs automated discovery on the remote host during initial contact, which includes executing 'ls -la ~' to list all files in the user's home directory, potentially exposing private file structures.
[COMMAND_EXECUTION]: The primary function of the skill involves executing shell commands and scripts on remote infrastructure through tools like c.call_command() and c.submit_job(). These operations are subject to user approval modals before execution.
[PROMPT_INJECTION]: The skill establishes a surface for indirect prompt injection by ingesting data from remote job logs and harvested output files. It also maintains a persistent state in the compute_details tool that is influenced by remote activities.
Ingestion points: Remote command logs, harvested job output files, and the compute_details durable store.
Boundary markers: None specified; the agent is instructed to trust discovery information stored in the durable fact document.
Capability inventory: Remote shell command execution, job submission, and file download capabilities.
Sanitization: No explicit validation or escaping of content retrieved from remote systems is described.

remote-compute-ssh