The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to treat $ARGUMENTS as a search term for log files when other specific filters are not used. The instructions lack guidance for the agent to sanitize or escape this input before interpolating it into shell commands like grep, which can lead to command injection if a malicious search term is provided.
[COMMAND_EXECUTION]: The skill performs process termination using kill based on PIDs retrieved from local marker files (e.g., logs/.sim-capture.pid). While the skill includes a validation step using ps to verify the command string associated with the PID before execution, the pattern of managing system processes based on file-derived input is a sensitive operation.
[PRIVILEGE_ESCALATION]: The instructions explicitly direct the agent to prompt the user to execute a local script using the platform's dynamic context syntax (! ./scripts/collect_device_logs.sh) to facilitate interactive sudo access. This bypasses standard user interaction patterns in favor of high-privilege operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes and summarizes untrusted data from log files (e.g., logs/sim-*.log, logs/device_*.txt). It lacks necessary security measures for this attack surface:
Ingestion points: Data is read from multiple log files created by background capture processes.
Boundary markers: No delimiters or "ignore embedded instructions" warnings are utilized when presenting log content to the agent.
Capability inventory: The skill possesses the ability to kill processes, remove files, and execute shell searches.
Sanitization: There is no evidence of filtering or sanitizing the log content before it is processed by the agent, allowing potential malicious instructions embedded in logs to influence agent behavior.

logs-stop