The Agent Skills Directory

[PERSISTENCE]: The skill provides instructions and commands for installing the agent as a background service on various operating systems, which ensures the agent runs across sessions and on system boot:
On Linux, it creates a systemd user service at ~/.config/systemd/user/mercury-agent.service and requires the loginctl enable-linger command to persist without active sessions.
On macOS, it creates a LaunchAgent plist file at ~/Library/LaunchAgents/org.cosmicstack.mercury-agent.plist.
On Windows, it creates a scheduled task using the schtasks utility.
[COMMAND_EXECUTION]: The framework includes a run_command tool that enables the agent to execute arbitrary shell commands on the host system. The documentation also guides the user to perform sensitive manual commands such as npm i -g @cosmicstack/mercury-agent, brew install gh, and gh auth login.
[PRIVILEGE_ESCALATION]: Deployment and maintenance tasks involve operations with elevated or sensitive permissions:
Recommends the use of sudo loginctl enable-linger $USER to modify session persistence.
Mentions sudo apt install gh for installing dependencies on Linux.
Interacts with system-level service managers (systemd) and task schedulers (schtasks) to establish persistence.
[DYNAMIC_EXECUTION]: The skill documents tools that download or execute code at runtime:
The install_skill tool allows the agent to fetch and install community-created skills from external sources into ~/.mercury/skills/.
The run_command tool allows for the dynamic execution of scripts and binaries.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an environment vulnerable to indirect prompt injection due to its broad access to external data and powerful tools:
Ingestion points: The agent receives untrusted input via a Telegram bot interface and through filesystem operations like read_file and list_dir (e.g., processing a project's source code or PR diffs).
Capability inventory: The agent possesses high-impact tools including run_command, write_file, delete_file, and send_message (allowing external exfiltration).
Boundary markers: While the skill mentions a permission system (permissions.yaml) and an 'Ask Me' mode, these are user-configurable and may be bypassed or auto-approved under adversarial influence.
Sanitization: The framework includes a command blocklist intended to filter dangerous patterns like sudo, rm -rf /, and dd if=, which serves as a security control but does not address all possible injection vectors.
[EXTERNAL_DOWNLOADS]: The skill initiates external downloads for both its core framework and auxiliary tools:
Installs the Mercury Agent package using npx @cosmicstack/mercury-agent or npm install -g @cosmicstack/mercury-agent.
Fetches external content via the fetch_url tool and installs secondary packages via install_skill.

mercury-agent-deployment