The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires root privileges to function, as evidenced by the sudo bash usage in SKILL.md and the internal script calls to sudo virtualmin. This constitutes a privilege escalation pattern where the agent is granted full administrative access to the hosting control panel.
[COMMAND_EXECUTION]: Shell scripts like scripts/modify-dns.sh interpolate variables such as $ACTION and $VALUE directly into commands executed with sudo. This dynamic construction of command flags (e.g., --"$ACTION"-record) and parameters without robust validation creates a significant surface for command and argument injection.
[COMMAND_EXECUTION]: In scripts/set-dkim.sh, the use of "${EXTRA_ARGS[@]}" allows arbitrary flags to be passed to the privileged virtualmin command without validation, enabling potential abuse of the underlying tool's capabilities.
[COMMAND_EXECUTION]: The skill is vulnerable to indirect prompt injection because it processes external data like domain names and DNS values without boundary markers or validation. Untrusted data enters the agent context through command-line variables (Ingestion points). There are no delimiters or instructions to ignore embedded commands (Boundary markers). The skill possesses high-privilege capabilities including system configuration via sudo virtualmin (Capability inventory). No escaping or validation is performed on the variables before they are passed to the shell (Sanitization).

virtualmin-dns