The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata (hostnames, user names, tags) from the Headscale tailnet via API and CLI tools. This data is incorporated into the agent's context, potentially allowing an attacker who controls a node to influence the agent's behavior.
Ingestion points: Node listing and status data processed in hs-list-nodes.sh, hs-approve-nodes.sh, and hs-tag-node.sh.
Boundary markers: No specific delimiters or warnings are used to separate untrusted node data from instructions.
Capability inventory: The skill allows the agent to approve new nodes, delete existing nodes, and modify security tags.
Sanitization: No sanitization or validation is performed on hostnames or other metadata retrieved from the server.
[COMMAND_EXECUTION]: Several scripts (hs-list-nodes.sh and hs-tag-node.sh) construct Jq filter strings by directly interpolating shell variables into quoted strings. This pattern is vulnerable to Jq expression injection if an input contains unexpected characters (e.g., quotes), which could be used to alter the script's logic or filter results.
Evidence: In hs-list-nodes.sh, the $USER_FILTER variable is placed directly inside a double-quoted Jq select statement. Similarly, hs-tag-node.sh interpolates the $NODE variable into a filter string to resolve node IDs.

headscale-node-lifecycle