The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on sudo to run the virtualmin CLI tool for system-level administration. This includes tasks like managing user accounts, modifying web server configurations, and handling disk quotas, which are necessary for its stated purpose.
[CREDENTIALS_UNSAFE]: Some scripts, such as create-domain.sh, accept passwords as command-line arguments. While this is a standard operational pattern for the virtualmin CLI, it is a point of note that credentials passed this way are handled in plaintext during the execution phase.
[DATA_EXFILTRATION]: The script transfer-domain.sh allows for the migration of server data to a remote host via SSH. This is a legitimate administrative feature but grants the agent the capability to move entire virtual server environments between systems.
[PROMPT_INJECTION]: Scripts like modify-domain.sh and modify-web.sh employ a pass-through mechanism (EXTRA_ARGS) for command-line arguments. This allows the agent to pass arbitrary flags directly to the high-privilege virtualmin command, which represents a potential surface for argument injection if the input is not carefully managed.

virtualmin-domains