The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs a wide range of powerful system and disk manipulation tools including dd, mount, mkfs, guestfish, virt-copy-in, fdisk, sfdisk, and sgdisk. While these are necessary for the skill's purpose, they grant the agent significant control over storage and filesystem structures.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of QEMU disk, SD, eMMC, and firmware images.
Ingestion points: Disk images, firmware, and partition data are identified as primary targets for inspection and extraction in SKILL.md and references/packaging.md.
Boundary markers: The skill defines explicit modes (inspect, extract, package) and requires an audit workflow (audit.md) to document intent before action.
Capability inventory: The agent can perform raw disk writes (dd), mount filesystems (mount), and extract contents using tools like binwalk and 7z.
Sanitization: The references/packaging.md file contains a warning to treat extraction output as untrusted data and avoid executing extracted binaries.
[PERSISTENCE]: The skill instructs the agent to modify the local git configuration (git rev-parse --git-path info/exclude) to hide its working directories (.agents/, .oh-my-qemu/, builds/) from the user's view in tools like git status. This behavior facilitates the persistence of the agent's environment within a repository without immediate user awareness through standard git commands.
[SAFE]: The skill references QEMU's official GitLab repository as the authoritative upstream source for documentation and code provenance.

qemu-image