The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses common shell utilities including curl, jq, awk, and tr to interact with UniFi controllers. These operations are restricted to a user-defined local host IP or hostname and are necessary for the skill's primary function of managing network infrastructure.
[DATA_EXPOSURE]: The skill manages authentication tokens and session cookies for local UniFi OS consoles. It provides mechanisms for handling API keys and session cookies (stored in /tmp/uni.jar), which is standard practice for CLI-based automation tools. No hardcoded credentials or unauthorized data access patterns were found.
[INDIRECT_PROMPT_INJECTION]: The skill processes data returned from network devices (such as device names, client hostnames, and event logs). While this presents a theoretical attack surface for indirect prompt injection, the risk is assessed as low given the local nature of the data sources and the specific administrative context of the tool.

unifi-operator