The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides a Bash script in references/kubernetes-core.md that dynamically assembles and executes commands using environment variables $CONTEXT and $WINDOW_SECONDS. While the script includes basic numeric validation for the time window, the context variable is interpolated directly into kubectl commands without sanitization. This creates a risk of shell command injection if the agent does not properly validate the user-supplied context or alias before populating the environment variable.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface across several files.
Ingestion points: The skill ingests untrusted data from the outputs of kubectl, helm, dig, and openssl, as well as from local configuration files located in the protected/ directory.
Boundary markers: While the instructions advise summarizing evidence, there are no mandatory delimiters or explicit 'ignore embedded instructions' warnings for the data being interpolated into the agent's context.
Capability inventory: The skill possesses extensive capabilities, including executing subprocesses for cluster interaction and network diagnostics, and performing file writes for audit reporting.
Sanitization: Sanitization is only partially implemented through the use of jq to filter specific JSON fields in event logs, but it is not consistently applied to other tool outputs or local configuration data.
[COMMAND_EXECUTION]: The core functionality of the skill is built around executing powerful CLI tools (kubectl, helm, dig, openssl, ssh) with arguments influenced by user input. This represents a broad attack surface, especially when combined with the dynamic script generation identified in the core references.

kubernetes-health