The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation workflow provides instructions to download a binary/script from https://docs.robusta.dev/master/_static/robusta, modify its permissions, and execute it locally. This pattern of downloading and running remote code is a high-risk vector if the source or transport is compromised.
[REMOTE_CODE_EXECUTION]: The skill documents the playbookRepos configuration, which allows for dynamic loading and execution of custom Python actions from external Git repositories (e.g., https://github.com/my-org/my-playbooks). This enables the execution of arbitrary external code within the agent's environment.
[COMMAND_EXECUTION]: Several actions described in the skill, such as node_bash_enricher and pod_bash_enricher, provide a direct interface for executing arbitrary shell commands (e.g., df -h, ls -la /app) on Kubernetes host nodes or within pod containers. These capabilities are intended for diagnostic purposes but present a high-impact surface for unauthorized command execution.
[PRIVILEGE_ESCALATION]: The installation guide includes the use of chmod +x on a script downloaded from a remote URL to grant it execution privileges. This is a common step in privilege escalation or malware delivery chains.
[INDIRECT_PROMPT_INJECTION]: The skill creates an automated pipeline that processes external data and triggers powerful actions.
Ingestion points: The agent ingests data from Kubernetes warning events (on_kubernetes_warning_event) and Prometheus alerts (on_prometheus_alert), both of which can contain untrusted, attacker-controllable strings in pod names, container labels, or log messages (found in references/Triggers.md and SKILL.md).
Boundary markers: No specific delimiters or instructions to ignore embedded commands within alert metadata were identified.
Capability inventory: The skill possesses the ability to delete resources (delete_pod), execute shell commands on the host node (node_bash_enricher), and perform outbound network requests (send_to_webhook) as documented in references/Actions.md.
Sanitization: While the logs_enricher action supports regex_replacer_patterns for redacting sensitive log data, there is no evidence of generalized input validation or sanitization for alert metadata before it is interpolated into remediation workflows.

robusta-dev