The Agent Skills Directory

[SAFE]: The skill establishes clear security boundaries by requiring explicit authorization for every diagnostic and mutation step and separating analysis from execution (Rule 2, Rule 15, SKILL.md).
[SAFE]: Instructions promote least-privilege principles, specifically advising against the use of root accounts, broad permissions (chmod 777), and the granting of unnecessary capabilities like CAP_SYS_ADMIN (Rule 8, Rule 9, service-privileges-and-limits.md).
[SAFE]: The skill mandates secure handling of credentials, prohibiting the inclusion of private keys, passwords, or secret environment variables in logs or reports (Core Rules, SKILL.md; consistent-cutover guidance, backup-and-restore.md).
[SAFE]: External references and dependencies found in NOTICE.md and SOURCES.yaml target reputable projects (e.g., restic, systemd, nftables) for documentation and curation purposes, with no patterns of unverified remote code execution or automated script downloads detected.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external system evidence (logs, configuration files, and command outputs provided in evals/files/). This creates an attack surface for indirect prompt injection where malicious instructions could be embedded in the processed data. This risk is effectively mitigated by mandatory evidence gates, a structured output template for reporting, and explicit rules requiring the agent to state exactly what each check proves rather than following instructions within the data (Rule 16, Output Format, SKILL.md).

linux-ops