The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/inspect-agent.sh uses string interpolation to embed shell arguments (AGENT_ID, PROJECT_ID, REGION) directly into a Python code block executed via python3 -c. A maliciously crafted argument could break out of the string literal and execute arbitrary Python code within the agent's environment.\n- [COMMAND_EXECUTION]: The skill makes extensive use of system commands through the Bash tool and Python's subprocess module to query cloud infrastructure. While necessary for its diagnostic purpose, the lack of input sanitization in the associated shell scripts increases the risk of command injection.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and parses metadata from the Vertex AI API (e.g., agent names, display names, and configurations). This creates a surface where malicious instructions embedded in a cloud resource's metadata could influence the agent's behavior during inspection.\n
Ingestion points: Metadata is retrieved via vertexai.Client().agent_engines.get() in scripts/check-security.py and scripts/inspect-agent.sh.\n
Boundary markers: No specific boundary markers or instructions are used to separate API data from agent instructions.\n
Capability inventory: The skill has access to shell execution via subprocess.run and the Bash tool, as well as network access via curl and the Google Cloud SDK.\n
Sanitization: Metadata is processed using jq and json.loads, but is not sanitized for potential prompt injection payloads before being presented to the agent.

vertex-engine-inspector