The Agent Skills Directory

[PERSISTENCE]: Implements automated, persistent reverse SSH loops that ensure the VM maintains a constant outbound connection to a remote peer for inbound access.
[PERSISTENCE]: Hardcodes a specific SSH public key ("muse-hop") into the authorized_keys file by default during setup, granting permanent remote access to a specific identity.
[COMMAND_EXECUTION]: Extensively uses complex shell scripts to manage system users, configuration files, and daemon lifecycles in an ephemeral container environment.
[PRIVILEGE_ESCALATION]: Utilizes 'unshare -m' to create private mount namespaces, allowing the Tailscale daemon to bypass system-level DNS and routing restrictions.
[REMOTE_CODE_EXECUTION]: Configures a "Reverse Shell" pattern via SSH reverse port forwarding, enabling a remote peer machine to execute commands on the local VM.
[EXTERNAL_DOWNLOADS]: Fetches binaries for OpenSSH and Tailscale from official Ubuntu and Tailscale package repositories during the setup process.
[COMMAND_EXECUTION]: Disables standard SSH security features ('StrictModes no') to accommodate platform-specific file system permission requirements on the persistent home volume.
[DYNAMIC_EXECUTION]: Dynamically generates and writes multiple shell scripts and a Python proxy helper to the file system at runtime to manage the remote access stack.
[COMMAND_EXECUTION]: Modifies the user's ~/.bashrc file to persistently source custom environment configurations and secret-handling logic.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Reads configuration data from local .env files and processes output from network status tools like 'tailscale status' and 'dig'.
Boundary markers: Lacks explicit markers or instructions for the agent to distinguish between its own logic and potentially malicious embedded data in processed inputs.
Capability inventory: The skill provides full shell execution, file system manipulation, and network pivoting capabilities to the agent.
Sanitization: Employs basic output masking using 'sed' to prevent Tailscale authentication keys from being exposed in logs.

muse