The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands on a remote host (raspberrypi.local) via SSH. User-provided input (bot-name) is directly interpolated into these commands, which can lead to command injection if a user provides a malicious string designed to break out of the shell quotes.
Evidence: ssh pi@raspberrypi.local "grep BOT_API_TOKEN /home/pi/{bot}/.env" and ssh pi@raspberrypi.local "echo 'BOT_API_TOKEN={token}' >> /home/pi/{bot}/.env".
[DATA_EXFILTRATION]: The skill is designed to read from and write to sensitive .env files located in various bot directories. While the instructions advise against reading full files, the agent is granted access to read and manipulate sensitive API tokens.
Evidence: Accesses files like /home/pi/keltner-bot/.env, /home/pi/ema-bot/.env, /home/pi/ml-bot/.env, /home/pi/telegram-bot/.env, and /home/pi/ema-cross-beyond-bot/.env.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface where untrusted user input is processed into shell commands with significant system capabilities.
Ingestion points: The [bot-name|all] argument from the user.
Boundary markers: None present in the workflow instructions.
Capability inventory: Remote shell command execution via SSH, file reading, and file appending.
Sanitization: No sanitization or validation steps are described for the {bot} parameter.

env-setup