The Agent Skills Directory

[COMMAND_EXECUTION]: Multiple utility scripts provided with the skill, including scripts/ensure-image-pull-secret.mjs and scripts/gh-refresh-scopes.mjs, are vulnerable to shell command injection. These scripts construct shell commands by interpolating variables (such as namespace, secretName, and scopeList) directly into template strings passed to sh -c or execSync without proper sanitization or escaping. Because some of these inputs originate from external API responses (e.g., the name field returned by the Sealos Template API), a malicious or compromised API could achieve remote code execution on the user's system.
[PROMPT_INJECTION]: The skill includes a 'Managed Mode' (enabled via the SEALAI_DEPLOY_MODE=managed environment variable) designed for autonomous orchestration. This mode explicitly instructs the agent to suppress user interaction, confirmation prompts, and OAuth flows, even when performing high-risk operations like system tool installation or resource deployment. This significantly elevates the potential impact of a successful injection.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a broad attack surface for indirect prompt injection. It clones arbitrary GitHub repositories and analyzes untrusted files including READMEs, package manifests, and source code. An attacker could craft a repository with malicious instructions to influence the agent's behavior during the assessment or deployment phases.
Ingestion points: Content from project files is read in scripts/score-model.mjs and scripts/workload-eligibility.mjs to determine deployment logic.
Boundary markers: While the instructions emphasize redacting secrets from logs, they lack explicit delimiters or 'ignore embedded instructions' warnings for the data being processed.
Capability inventory: The skill possesses extensive capabilities, including executing kubectl commands, running docker build, and making authenticated network requests to cloud APIs.
Sanitization: The skill lacks sanitization of data extracted from untrusted project files before it is used in shell commands or configuration templates.
[PRIVILEGE_ESCALATION]: Preflight instructions guide the agent to install system-level utilities like Docker, GitHub CLI, and kubectl. On Linux, the suggested installation method for Docker involves piping a remote script into a shell (curl | sh), which often requires sudo. While interactive mode mandates user confirmation, 'Managed Mode' removes this checkpoint, creating a path for automated privilege escalation.
[SAFE]: Automated alerts regarding malicious URLs (*.sealos.app) and related test files were determined to be false positives. These URLs are legitimate platform domains for user applications, and the flagged files are standard unit tests using these domains as fixture data. Additionally, instructions to redact sensitive values like Kubeconfig data from logs were evaluated as a positive security practice rather than an attempt to conceal malicious intent.

sealos-deploy