The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The scripts/ssh-env-check.sh script performs a scan of the user's ~/.ssh/ directory to identify private keys (ED25519, RSA, ECDSA). The resulting file paths are output to the agent's context. According to security guidelines, the discovery and exposure of sensitive file paths like private SSH keys is a high-severity data exposure finding.
[DYNAMIC_EXECUTION]: In Phase 4, the skill dynamically generates a companion agent file at .claude/agents/ssh-admin.md. This file is constructed by populating a template with data retrieved from the remote server (e.g., OS details, Docker configuration). Incorporating untrusted external data directly into an agent's instruction set without sanitization is a critical vulnerability that can lead to instruction injection or corruption of the agent's behavior.
[INDIRECT_PROMPT_INJECTION]: The skill ingests extensive output from remote servers via scripts/server-discover.sh, including OS distribution strings, container names, and service lists. This content is processed without boundary markers or sanitization, allowing a compromised or malicious remote host to inject instructions into the agent's prompt context during the discovery phase.
[COMMAND_EXECUTION]: The skill's primary function is to execute arbitrary commands on remote systems. While it implements a classification-based confirmation system (gating MODIFY, SERVICE, DELETE, and PRIVILEGE levels), the inherent capability to manage remote infrastructure via an LLM presents a significant security surface if the agent is misled regarding the command's intent or the server's identity.
[DATA_EXPOSURE]: The skill maintains a local CLAUDE.local.md file that stores an inventory of managed servers, including hostnames, usernames, and associated SSH key paths. Although the skill suggests gitignoring this file, the centralized storage of access metadata for multiple remote environments increases the impact of a local environment compromise.

ssh