The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides instructions and a mechanism for accessing highly sensitive files on the host system. It explicitly mentions using c.download() for paths such as ~/.ssh/*, .gitconfig, and .env, which are likely to contain private keys, access tokens, and other credentials.
[COMMAND_EXECUTION]: The skill uses the c.call_command() function to execute arbitrary shell commands on a remote host. This is used for environment discovery (e.g., ls -la ~, module avail) and software installation, providing a broad surface for command execution.
[REMOTE_CODE_EXECUTION]: The core functionality of the skill is centered around c.submit_job(), which enables the assembly and execution of arbitrary bash scripts on remote compute clusters. While this is the intended use case, it represents a powerful remote code execution capability.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it ingests and processes data from untrusted external sources (remote hosts) to drive its internal logic.
Ingestion points: The skill reads compute_details (durable session state), job exit codes, harvested output files in hpc/<jobId>/, and remote logs via r['stdout_tail'].
Boundary markers: There are no mentioned delimiters or boundary markers to distinguish between trusted instructions and untrusted data retrieved from the host.
Capability inventory: The skill has extensive capabilities including full shell access via c.call_command, job orchestration via c.submit_job, and arbitrary file access via c.download.
Sanitization: There is no description of sanitization, filtering, or validation of the data retrieved from the remote host before it is used to construct subsequent commands or update session state.

remote-compute-ssh