The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions direct the agent to use sudo on a remote host via SSH to copy protected files (bot_state.db) and modify permissions (chmod 644), which is a privilege escalation pattern.
[CREDENTIALS_UNSAFE]: The skill contains commands to read from the .env file on a remote machine using grep, which can expose sensitive configuration and secrets.
[DATA_EXFILTRATION]: The skill facilitates the transfer of sensitive data (database files, logs, and environment configuration) from a remote system to the local environment using scp and curl over a non-whitelisted domain (raspberrypi.local).
[PROMPT_INJECTION]: The skill processes untrusted external data from logs and CSV files, creating an indirect prompt injection surface. Evidence: 1. Ingestion point: ffm_diag.log and CSV files; 2. Boundary markers: Absent; 3. Capability inventory: ssh, scp, curl, and shell execution; 4. Sanitization: Absent.

audit-bot