The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The Filebeat service configuration includes a mount for the host's Docker socket (/var/run/docker.sock) and runs the process as the root user. This configuration allows the container to interact directly with the host's Docker daemon, representing a known surface for container escape or broader unauthorized access to the host environment.
[DATA_EXFILTRATION]: The provided templates disable built-in security features for Elasticsearch (xpack.security.enabled=false). While the ports are restricted to the local loopback interface (127.0.0.1) in the example, this unauthenticated setup creates a risk of sensitive log data exposure if the deployment is moved to a shared network or if host-level network isolation is bypassed.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of logs from external and potentially untrusted sources via Filebeat container monitoring and Logstash network inputs (ports 5044 and 5000). If the agent is subsequently tasked with analyzing these logs, it may execute malicious instructions embedded in the log content.
Ingestion points: Logstash pipeline beats/tcp inputs and Filebeat container log paths (/var/lib/docker/containers/*/*.log).
Boundary markers: Not implemented; the skill lacks instructions to the agent to treat summarized or processed log data as untrusted text.
Capability inventory: The skill requires high-privilege tools including kubectl, helm, and terraform for target environment management.
Sanitization: Logstash filters structure data into records but provide no semantic sanitization to prevent an LLM from interpreting the content of those records as instructions.

elk-stack