The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for running various shell commands, including git, grep, ls, docker, and kubectl. It specifically encourages using an external tool named rtk as a wrapper for these commands to filter their output.
[DATA_EXFILTRATION]: The skill interacts with potentially sensitive information, such as container logs and git diffs. While the instructions focus on summarization rather than external transmission, these sources often contain credentials or proprietary data.
[PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by processing untrusted output from shell commands (like reading files or logs) and incorporating it into the conversation context while the agent has shell capabilities.
Ingestion points: Commands like cat, rtk read, docker logs, and kubectl logs in SKILL.md bring external data into the session.
Boundary markers: The skill does not provide any specific delimiters or instructions to the agent to treat filtered shell output as untrusted or separate from instructions.
Capability inventory: The agent is granted access to a wide range of sensitive shell tools, including git, docker, kubectl, and package managers (npm, cargo).
Sanitization: There are no requirements for sanitizing or escaping the data read from files or logs before it is analyzed by the agent.

rtk-assisted-shell