The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides explicit instructions to retrieve and decode Kubernetes registry credentials.
Evidence: In references/crash-diagnosis.md, the command kubectl get secret <pull-secret> -n <namespace> -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d is used to expose raw authentication data.
[COMMAND_EXECUTION]: The skill relies on several high-privilege Kubernetes operations that grant significant access to the cluster and underlying infrastructure.
Evidence: Use of kubectl exec for container access and kubectl debug node/ in references/crash-diagnosis.md and references/resource-debugging.md.
The node debugging command specifically grants host-level access, allowing the agent to chroot /host and access node-level logs and filesystems.
[DATA_EXFILTRATION]: Sensitive cluster information and credentials are recovered and processed within the agent's execution environment.
Evidence: The diagnostic flow extracts environment variables (kubectl exec ... -- env) and decoded secrets, bringing them into the active context where they could be further manipulated or exposed.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the Kubernetes environment.
Ingestion points: The agent reads data from kubectl logs, kubectl describe, and kubectl get events in SKILL.md and references/crash-diagnosis.md.
Boundary markers: No boundary markers or instructions to ignore embedded commands within logs or events are provided.
Capability inventory: The agent possesses high-privilege capabilities including container execution (kubectl exec), node debugging (kubectl debug), and workload modification (kubectl rollout undo).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from logs or event descriptions.

kubernetes-debugging