The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation and installation guides recommend executing a remote script by piping curl output directly into bash (curl -sL https://run.surfpool.run/ | bash). This pattern bypasses code verification and facilitates arbitrary remote code execution on the host system. Findings occur in SKILL.md, resources/cli-reference.md, and docs/troubleshooting.md.
[COMMAND_EXECUTION]: The skill leverages a DSL engine (txtx) to execute Infrastructure as Code runbooks. These runbooks can perform sensitive operations such as Solana program deployments and transaction execution, which are equivalent to arbitrary command execution within the agent's execution scope.
[PROMPT_INJECTION]: The skill ingests configuration from Surfpool.toml and runbook files (*.tx) to drive agent behavior. These files are processed without boundary markers or explicit safety instructions, exposing the agent to indirect prompt injection vulnerabilities.
Ingestion points: Surfpool.toml manifest and deployment.tx runbooks.
Boundary markers: No delimiters or ignore-instructions markers are present in the processing logic.
Capability inventory: Shell execution (surfpool start), file system writes for program deployment, and network operations for blockchain interaction.
Sanitization: No sanitization or validation of configuration content is performed prior to execution.

surfpool