The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes a functional example that downloads and executes a script from an unverified external URL, which is a significant security risk if executed on a target system.
Evidence in SKILL.md: The runcmd block containing curl -fsSL https://example.com/setup.sh -o /opt/setup.sh, chmod +x /opt/setup.sh, and /opt/setup.sh.
[EXTERNAL_DOWNLOADS]: The skill references downloading configuration and code from external sources.
Evidence in SKILL.md: Fetches package repository data from https://download.docker.com/linux/ubuntu and a setup script from https://example.com/setup.sh.
[PRIVILEGE_ESCALATION]: The skill provides numerous templates for creating users with full, passwordless sudo permissions and modifying root-owned system configurations.
Evidence in SKILL.md: sudo: ALL=(ALL) NOPASSWD:ALL for new users, and instructions to modify /etc/ssh/sshd_config, /etc/docker/daemon.json, /etc/systemd/system/, and /etc/sysctl.conf.
[INDIRECT_PROMPT_INJECTION]: The skill functions as a template generator for high-privilege configurations executed on remote servers, creating a surface where malicious instructions could be embedded in the generated output.
Ingestion points: Examples and documentation within SKILL.md used to guide agent output.
Boundary markers: Absent; there are no specific delimiters or warnings to treat generated cloud-init content as potentially dangerous.
Capability inventory: The skill guides the creation of configurations capable of arbitrary file writing (write_files), network operations (curl), and shell command execution (runcmd) with root privileges.
Sanitization: Absent; the skill lacks mechanisms to sanitize or validate the content it helps generate for deployment to sensitive environments.

cloud-init-coder