The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The templates/custom-runner.Dockerfile and references/custom-images.md include instructions to grant the runner user passwordless sudo permissions (NOPASSWD:ALL), allowing any code executed within the environment to obtain root access to the container.\n- [PRIVILEGE_ESCALATION]: The templates/docker-compose.yml template mounts the host Docker socket (/var/run/docker.sock) into the runner container. This provides the containerized runner with full control over the host Docker daemon, creating a path for container escape or host compromise.\n- [EXTERNAL_DOWNLOADS]: The skill fetches runner application binaries and container hooks from GitHub's official repositories (github.com/actions/runner and github.com/actions/runner-container-hooks).\n- [EXTERNAL_DOWNLOADS]: The deployment templates reference the use of a community-maintained Docker image (myoung34/github-runner) for runner management.\n- [INDIRECT_PROMPT_INJECTION]: The skill sets up infrastructure designed to process untrusted data from external sources, which creates a surface for indirect injection attacks.\n
Ingestion points: Pull request metadata (titles, bodies) and repository source code as described in SKILL.md and references/security.md.\n
Boundary markers: The references/security.md guide recommends the use of intermediate environment variables to separate untrusted data from shell script logic.\n
Capability inventory: The runner environment allows arbitrary command execution, outbound network access, and system-level privileged operations via sudo or Docker.\n
Sanitization: Instructions advise pinning actions to commit SHAs and using OIDC, although the system is designed to execute code provided by repository contributors.\n- [COMMAND_EXECUTION]: The documentation describes the execution of service management scripts (svc.sh) and configuration utilities (config.sh) directly on the host operating system for runner registration and maintenance.

github-runner