The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains multiple Python scripts that execute shell commands using the subprocess module.
In references/automation-toil.md, the AutomatedRunbook class uses subprocess.run(shell=True) to execute arbitrary command strings. This is a dangerous pattern that can lead to remote command execution if the runbook steps are sourced from untrusted data.
In SKILL.md, the Toil Automation Script uses sys.argv to populate a kubectl rollout restart command. While passed as a list, the lack of validation on these arguments could lead to unintended behavior if inputs are user-controlled.
The skill uses high-privilege commands including systemctl restart, iptables (via kubectl exec), and tc (traffic control) for system remediation and chaos experiments.
[EXTERNAL_DOWNLOADS]: Network operations are present for legitimate monitoring purposes.
The automation script in SKILL.md uses urllib.request to query a Prometheus API.
references/automation-toil.md uses curl to perform service health checks.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8).
Ingestion points: The skill reads and processes data from Prometheus metrics, Kubernetes logs (kubectl logs), and service health endpoints.
Boundary markers: None identified in the provided scripts to distinguish between data and instructions.
Capability inventory: The skill has broad capabilities including file deletion (find ... -delete), service restarts (systemctl, kubectl), and network configuration changes (iptables, tc).
Sanitization: Minimal sanitization is observed (e.g., urllib.request.quote for URL queries), but command-line arguments and data from logs are interpolated into shell commands without sufficient validation or escaping.

sre-engineer