The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses highly sensitive files in the user's home directory, including SSH private keys (~/.ssh/id_*) and the SSH configuration file (~/.ssh/config). This information is gathered during environment checks and server setup to facilitate remote connections.
[DYNAMIC_EXECUTION]: The skill dynamically generates and writes a new AI agent configuration file (.claude/agents/ssh-admin.md) at runtime. This file is constructed from a template and populated with server inventory data, creating a new executable context for sub-tasks.
[COMMAND_EXECUTION]: The skill provides the ability to execute arbitrary shell commands on remote servers via SSH. Although it implements a command classification system and requires user confirmation for destructive or privileged actions, the core functionality enables remote command execution.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting data from remote servers through the server-discover.sh script.
Ingestion points: The output of remote commands (such as OS details, Docker information, and service lists) is read and stored in local configuration files (CLAUDE.local.md) and used in generated agent prompts.
Boundary markers: The skill does not use explicit boundary markers or delimiters when interpolating remote command output into instructions, which could allow malicious server responses to influence the agent's behavior.
Capability inventory: The agent has access to Bash, Agent, Write, and Edit tools, allowing it to modify local files or spawn sub-agents based on the ingested data.
Sanitization: Sanitization is limited to basic character removal (e.g., using tr or sed), which may not prevent complex payload injection from a compromised or malicious remote server.

ssh