The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data by instructing the agent to read Kubernetes pod logs and cluster events. This content could be manipulated by an attacker who has compromised a container within the cluster to provide malicious instructions to the agent.
Ingestion points: The skill directs the agent to use kubectl logs, kubectl get events, and helm status to gather data from the cluster environment in both SKILL.md and REFERENCE.md.
Boundary markers: The instructions do not provide delimiters or specific warnings to ignore instructions found within logs or event data, increasing the risk of the agent accidentally executing embedded commands.
Capability inventory: The agent uses the Bash tool to perform sensitive operations like helm upgrade, kubectl delete, and kubectl create secret, which could be exploited if the agent is successfully injected.
Sanitization: There are no instructions for sanitizing or validating the text content retrieved from the cluster before it is processed by the agent.

helm-debugging