The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The bootstrap-node.sh script downloads the official Tailscale installation script and pipes it directly to the shell (curl -fsSL https://tailscale.com/install.sh | sh).
[REMOTE_CODE_EXECUTION]: The bootstrap process clones the author's onmax/skills repository and executes local scripts, such as sync-remote-skills.sh, which are not included in the primary skill payload.
[COMMAND_EXECUTION]: The skill uses sudo to perform high-privilege system operations, including managing user accounts (useradd, usermod), creating groups, and installing global packages via apt and npm (@openai/codex).
[COMMAND_EXECUTION]: The script modifies system-wide firewall settings (ufw) to restrict public SSH access and allow traffic on the Tailscale network interface.
[EXTERNAL_DOWNLOADS]: Fetches GPG keys and repository configuration from well-known services, including Docker and the GitHub CLI, to configure system package managers.
[CREDENTIALS_UNSAFE]: The bootstrap script propagates access by copying the administrator's authorized_keys file to newly created agent user profiles.
[PROMPT_INJECTION]: The load-sharing architecture described in REFERENCE.md involves worker nodes receiving 'tasks' and 'verification commands' from a coordinator. This creates an indirect prompt injection surface where a compromised coordinator could send malicious instructions to be executed by worker nodes.

fleet