The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly references sensitive private SSH key paths, which are used to authenticate with remote servers.
Evidence: ~/.ssh/id_siliconvalley and ~/.ssh/id_vultr in SKILL.md.
[COMMAND_EXECUTION]: The skill provides scripts that execute administrative commands on remote servers via SSH, including package installation and system service management.
Evidence: Use of ssh, apt-get install, and systemctl within the reconstruction scripts.
[PRIVILEGE_ESCALATION]: The instructions utilize sudo to modify restricted system configuration files and manage global services.
Evidence: Modification of /etc/ssh/sshd_config to disable password authentication and modification of /etc/tinyproxy/tinyproxy.conf.
[PERSISTENCE]: The skill implements a persistence mechanism by modifying the system's crontab to ensure an SSH tunnel is automatically restarted every five minutes.
Evidence: crontab -l 2>/dev/null | ... >> /tmp/cron_new; crontab /tmp/cron_new sequence in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The reconstruction script defines a variable NEW_IP and interpolates it directly into a shell command, which represents a command injection surface if the agent accepts untrusted input for the IP address.
Evidence: ssh -o StrictHostKeyChecking=no ... ubuntu@$NEW_IP where $NEW_IP is a placeholder for user-supplied data.
[DATA_EXPOSURE]: Hardcoded IP addresses (43.159.133.35, 106.54.241.187) and administrative usernames are exposed within the skill instructions.

vps-disaster-recovery