The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to read highly sensitive credential files from the target node's mounted filesystem.
Evidence: Accessing $SNAP/etc/shadow to check and modify root account status.
Evidence: Accessing /mnt/@/root/.ssh/authorized_keys to inspect and modify SSH access.
Evidence: Accessing /mnt/@/var/lib/rancher/k3s/server/token to retrieve Kubernetes authentication tokens.
Evidence: Accessing $SNAP/etc/ssh/ssh_host_* to view private host keys.
[COMMAND_EXECUTION]: The skill utilizes the hcloud CLI and shell commands to manipulate cloud infrastructure and server files.
Evidence: Uses the official Hetzner Cloud CLI (hcloud) to manage server state via enable-rescue, reboot, and disable-rescue commands.
Evidence: Uses sed -i to modify system authentication files such as /etc/shadow to unlock the root account.
Evidence: Uses chroot to execute commands within the context of the mounted target filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes system logs which may contain untrusted data, combined with powerful administrative capabilities.
Ingestion points: Reads /var/log/cloud-init.log, journalctl output, and /var/log/audit/audit.log in SKILL.md.
Boundary markers: Absent. The agent reads raw log output without delimiters or warnings.
Capability inventory: Shell access, file writing (sed), and cloud infrastructure control (hcloud) documented in SKILL.md.
Sanitization: Absent. External content is read directly into the context.
[DATA_EXFILTRATION]: The skill enables the extraction of sensitive system state and credentials from the environment into the agent's context, which could lead to unauthorized data exposure.

debug-node