The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions specify that the agent should follow contents of the ai_notes field as user instructions. This allows data from remote host configurations to override agent behavior.
Ingestion points: The ai_notes field retrieved from host metadata via the hatoba CLI.
Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands within the notes.
Capability inventory: The agent can execute arbitrary shell commands (hatoba exec), transfer files (hatoba cp), and use root privileges (--sudo) on remote hosts.
Sanitization: Absent; the skill does not provide methods for sanitizing or validating the content of the notes.
[COMMAND_EXECUTION]: The skill provides the agent with the capability to execute arbitrary commands on remote SSH hosts, which is a high-impact capability if misused.
[PRIVILEGE_ESCALATION]: The skill explicitly describes how to use the --sudo flag to perform actions with root privileges on remote servers.
[EXTERNAL_DOWNLOADS]: The skill directs users to download the Hatoba CLI from an unverified third-party domain (hatoba.fog.moe).

hatoba-cli