The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md direct the user to download and execute shell scripts directly from raw.githubusercontent.com/kvcache-ai/ by piping them to bash. This is a dangerous pattern that allows remote code to run on the host system without prior inspection.
[PRIVILEGE_ESCALATION]: The setup process for the server and Docker environments explicitly uses sudo bash to execute remote scripts. This grants the external content full root access to the host machine during installation.
[EXTERNAL_DOWNLOADS]: The skill fetches software components and configuration scripts from external sources, including kvcache-ai.github.io for Helm charts and ghcr.io/kvcache-ai/ for Docker images. These third-party sources are not among the predefined trusted organizations.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it is designed to ingest and execute code within sandboxed environments.
Ingestion points: User-provided instructions or data can be passed into the microVM sandboxes via the aenv exec CLI tool or the E2B SDK integration (SKILL.md).
Boundary markers: The instructions lack explicit boundary markers or system prompts advising the agent to ignore instructions embedded within the processed data.
Capability inventory: The skill supports arbitrary command execution (aenv exec), file system manipulation (sandbox.filesystem.write), and network access within the Firecracker-based microVMs.
Sanitization: Security is primarily based on the hardware-level isolation of Firecracker microVMs, which protects the host but does not prevent the agent from being manipulated by malicious instructions contained within the sandbox's input data.

agentenv-distributed-agent-environments