The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The "Bulk User Creation from CSV" script in SKILL.md creates a surface for indirect injection by processing external data files.
Ingestion points: Reads user data from a CSV file specified via the CSV_FILE argument.
Boundary markers: None present; the script does not use delimiters or instructions to ignore embedded commands.
Capability inventory: The script has the ability to execute useradd, chpasswd, and chage with root-level privileges in SKILL.md.
Sanitization: The script performs minimal sanitization by replacing semicolons in the groups field, but it does not validate the shell or username fields, which are interpolated directly into shell commands.
[COMMAND_EXECUTION]: The skill utilizes high-privilege system commands to modify the environment.
Evidence: Instructions include using find / -uid ... -exec chown ... to recursively change ownership across the file system and userdel -r to delete user data in SKILL.md.
[PRIVILEGE_ESCALATION]: The skill provides templates and instructions for configuring administrative access and sudo permissions.
Evidence: Documentation includes examples for granting NOPASSWD access to the deploy user and developers group in /etc/sudoers.d/ as shown in SKILL.md.
[EXTERNAL_DOWNLOADS]: Fetches system administration packages (such as sssd, realmd, and adcli) from official distribution repositories using apt and dnf in SKILL.md.

user-management