The Agent Skills Directory

[DYNAMIC_EXECUTION]: The slack_runbook_handler.py script in references/automation.md implements a runtime execution pattern where local shell scripts are invoked with arguments derived from external HTTP POST requests.
Evidence: The Python script uses subprocess.run to execute diagnostic and restart scripts, passing user-supplied text as a list of arguments without validation.
[COMMAND_EXECUTION]: The provided automation scripts (e.g., diagnose-service.sh, safe-restart.sh, check-db-connections.sh) are vulnerable to command injection because they use shell variables directly in commands without quoting.
Evidence: In diagnose-service.sh, the command kubectl get pods -n $NAMESPACE -l app=$SERVICE will undergo shell expansion. If an attacker controls the $SERVICE or $NAMESPACE variables, they can inject arbitrary shell commands that will be executed by the interpreter when the script runs.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection by processing data from a Slack command interface to perform privileged operations like service restarts and database diagnostics.
Ingestion points: The handle_command function in slack_runbook_handler.py reads data from request.form.
Boundary markers: None identified; the script splits input by whitespace and assumes the resulting tokens are safe for use as script arguments.
Capability inventory: The skill includes templates for kubectl (cluster management), psql (database administration), pg_ctl (database promotion), and redis-cli (cache management).
Sanitization: There is no validation or escaping of the arguments before they are passed to the subprocess.run call or utilized within the downstream bash scripts.

runbook-creator