The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes multiple Python scripts and templates that execute high-privilege system commands via subprocess.run. These commands include Kubernetes management (kubectl rollout restart, kubectl patch), system service control (systemctl restart), and network configuration (iptables, tc). The AutomatedRunbook class in references/automation-toil.md specifically uses shell=True, which increases the risk of command injection if command strings are dynamically constructed.
[PRIVILEGE_ESCALATION]: The provided automation tools perform actions that typically require root or administrative access. For example, the chaos engineering scripts in references/incident-chaos.md use iptables to drop network traffic and tc to inject network latency, while references/automation-toil.md includes scripts to delete system logs (find /var/log ... -delete) and restart services.
[EXTERNAL_DOWNLOADS]: Automated reputation scanners flagged the author's documentation site (jeffallan.github.io) as blacklisted. This domain is referenced throughout the skill's metadata and documentation links, posing a risk if the site hosts malicious content.
[METADATA_POISONING]: The main skill file SKILL.md was detected as malicious (FileRepMalware) by automated file reputation scanners. This indicates that the file content or its structural patterns match known malicious signatures.
[INDIRECT_PROMPT_INJECTION]: The skill implements auto-remediation logic that triggers privileged actions based on external data fetched from a Prometheus server. An attacker capable of influencing the metrics processed by Prometheus (e.g., by manipulating application labels or request counts) could indirectly trigger automated restarts or service disruptions. The skill lacks explicit boundary markers or sanitization for the data returned from these external monitoring sources.
[REMOTE_CODE_EXECUTION]: Automated tools detected a pattern where data is fetched from a network source (http://prometheus:9090) and subsequently used in logic that leads to subprocess execution. While the current implementation parses JSON, the tight coupling between untrusted network data and privileged command execution represents a remote code execution risk surface.

sre-engineer