The Agent Skills Directory

[COMMAND_EXECUTION]: The skill enables arbitrary shell command execution on the host machine through the shell::exec and shell::exec_bg functions. The documentation acknowledges that the regex-based denylist is not a secure isolation boundary and can be bypassed by using language interpreters to construct forbidden tokens at runtime.
[DATA_EXFILTRATION]: The shell::fs::read and shell::fs::grep functions allow the agent to read file content from the host filesystem. Since the skill is unjailed by default, it can potentially access any sensitive file on the host that is not specifically blocked by a path denylist.
[CREDENTIALS_UNSAFE]: The combination of bypassable command execution and unjailed filesystem access creates a risk of exposure for host-level credentials, including SSH keys, cloud provider configurations, and environment variables.
[COMMAND_EXECUTION]: The shell::fs::chmod function supports modifying the uid and gid of files on the host, which provides a mechanism for privilege escalation.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection attack surface by reading untrusted data from the filesystem. 1. Ingestion points: shell::fs::read, shell::fs::grep, and shell::fs::sed (SKILL.md). 2. Boundary markers: None present. 3. Capability inventory: shell::exec, shell::fs::write, and shell::fs::chmod (SKILL.md). 4. Sanitization: No sanitization or validation of external content is specified.

shell