The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to perform administrative operations (rsync, PM2 management, script execution) using the root account on a remote production server (172.245.56.50). Performing routine tasks as the root user violates the principle of least privilege and increases the impact of any session compromise.
[COMMAND_EXECUTION]: The skill employs a dangerous shell pattern to extract credentials: eval "$(grep '^VERCEL_TOKEN=' .env)". Using eval on file content allows for arbitrary command execution if the .env file is maliciously modified or if the grep output contains unexpected characters.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of local scripts (deploy-to-racknerd.sh, update-ffmpeg.sh) on a remote production environment via SSH, establishing a workflow that executes potentially unverified code.
[DATA_EXFILTRATION]: The skill discloses specific production infrastructure details, including the public IP address of the VPS (172.245.56.50), internal Vercel project IDs (prj_AKC4gUSm2EWNj3RR8Cou4cILHYxp), and names of internal Aitable databases used for credential management.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it requires the agent to read and interpret pm2 logs from the production server. 1. Ingestion points: Remote server logs retrieved via ssh root@172.245.56.50 pm2 logs (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Network access (ssh, curl, rsync), file writes (rsync), and process management (pm2) on the remote server (SKILL.md). 4. Sanitization: None identified for log data processed by the agent.

deploy-ops