The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent is designed to process untrusted data from multiple external sources, which presents a surface for indirect prompt injection attacks.
Ingestion points: The skill ingests data from Kubernetes logs (references/data-sources.md), Prometheus metrics, PagerDuty incidents, GitHub issues, and Jira tickets (references/integrations.md).
Boundary markers: The documentation mentions custom post-processing prompts but does not specify strict delimiters or instructions to ignore embedded commands in the ingested data.
Capability inventory: The agent possesses extensive capabilities including shell command execution via /run and /shell, Kubernetes API access (get, list, watch), and network operations via curl (references/commands.md, references/data-sources.md).
Sanitization: There is no explicit documentation regarding the sanitization or escaping of content retrieved from external logs or alert systems before it is processed by the LLM.
[COMMAND_EXECUTION]: The skill documents and enables high-privilege command execution capabilities intended for troubleshooting.
Evidence: The interactive mode supports the /run <command> and /shell commands, allowing the AI to execute arbitrary shell operations or share interactive shell sessions with the user (references/commands.md).
Evidence: Custom toolsets defined in YAML allow the agent to execute shell commands and curl requests with parameters inferred by the AI (references/data-sources.md).
[EXTERNAL_DOWNLOADS]: The documentation includes instructions for downloading and executing scripts or packages from external sources.
Evidence: Provides a piped bash installation command for Ollama: curl -fsSL https://ollama.com/install.sh | sh (references/configuration.md).
Evidence: Instructions for adding vendor-specific Helm repositories: helm repo add robusta https://robusta-charts.storage.googleapis.com (references/installation.md).
[CREDENTIALS_UNSAFE]: The documentation instructs users on how to provide the agent access to highly sensitive local configuration files.
Evidence: Docker and CLI setup instructions require mounting or referencing sensitive paths such as ~/.kube/config, ~/.aws, and ~/.config/gcloud to enable the agent to interact with cloud infrastructure (SKILL.md, references/installation.md).

holmesgpt