The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses a sensitive local directory to read SSH public keys.
Evidence: public_key = file("~/.ssh/deploy.pub") in SKILL.md.
While the file accessed is a public key, accessing the ~/.ssh/ directory is a pattern associated with data exposure risks.
[PRIVILEGE_ESCALATION]: The provided cloud-init templates configure remote users with elevated system privileges.
Evidence: sudo: ALL=(ALL) NOPASSWD:ALL in the user_data section of SKILL.md.
This configuration allows the deploy user to execute administrative commands on the target Droplet without password authentication.
[INDIRECT_PROMPT_INJECTION]: The skill interpolates external variables directly into infrastructure code and remote execution scripts, which could be exploited if the data source is untrusted.
Ingestion points: Variable inputs such as var.project, var.deploy_ssh_key, and var.db_allowed_ips are used across SKILL.md and references/digitalocean-production-stack.md.
Capability inventory: The skill uses allowed-tools including Read, Write, and Bash, and generates user_data scripts that execute with root privileges on remote infrastructure.
Boundary markers: There are no explicit delimiters or instructions to prevent the agent from interpreting content within these variables as commands.
Sanitization: No validation or escaping is applied to the variables before they are embedded in the generated HCL code or cloud-config scripts.

digitalocean-coder