The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: The agent reads untrusted data from remote sources via commands like logs tail (fetching server/docker logs), db tables (fetching database schema/content), and reading remote config files as described in SKILL.md.
Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' instructions to wrap the output of these remote commands.
Capability inventory: The skill allows the agent to perform significant mutations on the remote host, including services restart, deploy (declarative deployments), and writing to config files (SKILL.md).
Sanitization: Absent. There are no instructions for filtering or validating the remote content before the agent processes it.
[DATA_EXFILTRATION]: The skill instructions permit the agent to read sensitive remote configuration files and database introspection data. While the connection credentials themselves are handled via a 'zero-knowledge' model, the content of the target files and databases is exposed to the agent's context, which could lead to exposure of secrets if the agent is subsequently prompted to relay this information.
[COMMAND_EXECUTION]: The skill relies on shell command execution by calling a compiled binary (sshepherd). The instructions mandate the use of an absolute path and advise against auto-discovery of the executable, which serves as a security best practice for this type of operational skill.

sshepherd