The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its data ingestion patterns.
Ingestion points: dcim/rack_monitor.py (via DCIMClient.get_rack_sensors) and dcim/netbox_sync.py ingest data from external DCIM APIs.
Boundary markers: None. Data is interpolated directly into logic and output.
Capability inventory: The skill has capabilities to perform network requests (requests.get), execute shell commands (ipmitool), and display output to the user.
Sanitization: No validation or sanitization is performed on ingested data (such as sensor locations or device names), which could allow an attacker who controls the DCIM metadata to inject instructions that the agent might follow.
[COMMAND_EXECUTION]: The skill provides utility scripts that execute shell commands to interact with hardware.
Evidence: automation/provision_server.sh uses ipmitool to set boot devices and reset power on physical servers. While legitimate for datacenter operations, these commands involve user-supplied IP addresses and credentials.
[EXTERNAL_DOWNLOADS]: The Python monitoring scripts utilize external network connections to interact with management infrastructure.
Evidence: dcim/rack_monitor.py uses the requests library to connect to arbitrary DCIM base URLs. dcim/netbox_sync.py uses pynetbox to communicate with Netbox instances.
[DECEPTIVE_CONTENT]: Eight reference files (e.g., references/architecture-patterns.md, references/security-best-practices.md) contain 150 sections each of near-identical, repetitive boilerplate text. This pattern is often used as an adversarial technique to fill the AI's context window with junk data to hide other content or degrade performance.

datacenter