The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions direct the agent to perform arbitrary Docker operations using the exec tool. This includes building images, running containers, and inspecting logs. In many environments, access to the Docker daemon is equivalent to root-level access on the host, which can be leveraged to manipulate the host filesystem or processes.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where malicious instructions embedded in external data could influence the agent's behavior.
Ingestion points: The skill explicitly suggests using read to inspect Dockerfiles and exec to view docker logs and container configurations (SKILL.md).
Boundary markers: There are no instructions to treat content from logs or Dockerfiles as untrusted data or to use delimiters to prevent instruction leakage.
Capability inventory: The skill leverages the exec tool, which provides the ability to execute further shell or Docker commands based on processed input.
Sanitization: No sanitization or validation logic is defined for the data retrieved from containers or configuration files.

docker