The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/api-request.sh constructs a shell command by interpolating variables such as $ENDPOINT, $DATA, and $JSON_PAYLOAD directly into a command string. This string is then executed inside a Docker container using docker exec ... bash -c "$CURL_CMD". Because these inputs are not properly escaped or sanitized for shell execution, a malicious user or an attacker-controlled API could provide input (e.g., using single quotes to break out of the wrapping) to execute arbitrary commands within the MikoPBX container.
[DYNAMIC_EXECUTION]: The skill uses dynamic execution by assembling a curl command at runtime based on the provided HTTP method and payload parameters, which is then passed to a shell for evaluation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external MikoPBX API responses and displays the results to the agent without sanitization or the use of boundary markers. This creates a vulnerability where malicious data stored in the PBX (e.g., in call records or extension names) could contain hidden instructions that trick the agent into performing unintended actions.
Ingestion points: API responses are captured and displayed by scripts/api-request.sh and various reference examples.
Boundary markers: None are present in the documentation or instructions to prevent the agent from following instructions embedded in the API output.
Capability inventory: The skill has access to docker exec, Bash tool, and Read tool, which could be abused if an injection is successful.
Sanitization: The skill only performs JSON pretty-printing via python3 -m json.tool, which does not strip or escape potential prompt injection content.

api-client