The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes a command pattern in SKILL.md that pipes network output to an interpreter: curl -s http://localhost:3000/api/health | python3 -m json.tool. While used for JSON formatting, this pattern is inherently risky as it could execute malicious code if the service on the local port is compromised or misconfigured.
[CREDENTIALS_UNSAFE]: Multiple files (SKILL.md, references/common-patterns.md) contain hardcoded credential strings and placeholders such as admin:password, admin:pass, and yourpassword. If executed literally, these could lead to the use of insecure or default credentials in production environments.
[COMMAND_EXECUTION]: The skill extensively uses sudo for various tasks including service management (systemctl), plugin installation (grafana-cli), and file system operations (cp, mkdir, tee). This provides a broad surface for privilege escalation if the agent's environment is not strictly scoped.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading dashboard JSON and plugins from grafana.com and github.com. While these are well-known and reputable services, the skill handles external content that is subsequently processed or executed by the system.

grafana