The Agent Skills Directory

[COMMAND_EXECUTION]: The automation and chaos engineering templates in SKILL.md, references/automation-toil.md, and references/incident-chaos.md utilize subprocess.run to interact with high-privilege system tools including kubectl, systemctl, iptables, and tc. These examples construct shell commands via direct string interpolation of variables like service names and namespaces, creating a command injection surface if these values are derived from untrusted input.
[COMMAND_EXECUTION]: The runbook automation logic in references/automation-toil.md specifically uses shell=True within subprocess.run calls. This execution mode invokes the system shell to parse command strings, which is a security risk as it allows for shell metacharacter injection.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface:
Ingestion points: The agent processes architecture reviews, SLO targets, incident reports, and monitoring data as part of its core workflow defined in SKILL.md.
Boundary markers: Absent; the skill lacks delimiters or specific instructions to the agent to ignore potentially malicious commands embedded in the SRE data.
Capability inventory: Scripts across SKILL.md, references/automation-toil.md, and references/incident-chaos.md have the capability to use subprocess.run for kubectl (restart/exec/patch), systemctl (restart), iptables (DROP/DELETE), tc (network delay injection), and find (file deletion).
Sanitization: Absent; the provided code examples show command strings being built using unsafe interpolation without validation or escaping.
[COMMAND_EXECUTION]: The self-healing scripts in references/automation-toil.md include file system operations like find /var/log -name "*.log" -mtime +7 -delete. If the path or search parameters are manipulated by an attacker through indirect input, it could result in unauthorized file deletion on the host system.

sre-engineer