The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read process environment variables directly from the filesystem using tr '\0' '\n' < /proc/<pid>/environ. This path typically contains sensitive information such as database credentials and API tokens.
Evidence: Found in cookbook/live-audit.md and cookbook/telegram.md. The skill attempts to mitigate this by providing sed commands to redact passwords, tokens, and secrets from the output before the agent processes it.
[PROMPT_INJECTION]: The skill analyzes system logs (journalctl) to diagnose Telegram bot issues. These logs can contain untrusted data from external users (e.g., message contents) which could be used for indirect prompt injection if an attacker crafts messages to influence the agent's behavior.
Ingestion points: journalctl commands in cookbook/telegram.md.
Boundary markers: None used for log output.
Capability inventory: Shell command execution, service management (systemctl), and network requests (curl).
Sanitization: Uses rg (ripgrep) to filter logs for specific keywords, but does not sanitize the content of the log lines themselves.
[COMMAND_EXECUTION]: The skill makes extensive use of powerful system commands including systemctl for service lifecycle management, ss for network monitoring, and ps for process inspection. While consistent with its stated purpose of 'Live Ops', these provide a significant attack surface if the agent is misled.

pawrrtal-live-ops