The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The verification instructions for the file_storage extension utilize permissive file system commands. In the file components/file_storage/verification.md, the command 'chmod -R 777 /tmp/fsverify' is included to grant global read, write, and execute permissions to a directory tree, which is a high-privilege configuration used to ensure containerized testing environments can access local storage.\n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it provides instructions for the agent to ingest and process telemetry data (logs, traces, metrics) which may originate from untrusted external sources. The skill also instructions the execution of sensitive shell commands (docker, kubectl, go run) for verification purposes. Ingestion points include logs and configurations described in components/drain/README.md and components/file_log/README.md. Boundary markers and explicit sanitization instructions for external content are largely absent in the provided verification recipes.\n- [EXTERNAL_DOWNLOADS]: The skill downloads software from a well-known project repository during its verification procedures. Verification recipes in components/load_balancing/verification.md and components/otlp_exporter/verification.md use 'go run' to fetch the telemetrygen tool from the official OpenTelemetry organization on GitHub.\n- [REMOTE_CODE_EXECUTION]: The skill performs remote code execution by fetching and running testing tools from an established and well-known project repository. It utilizes 'go run' to execute telemetrygen directly from github.com/open-telemetry/opentelemetry-collector-contrib in multiple verification files.\n- [COMMAND_EXECUTION]: The skill instructions the execution of numerous shell commands including docker, kubectl, go, and curl across its component verification files for the purpose of testing Collector configurations.

otel-collector