The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents several methods for executing arbitrary commands within guest VMs, which could be exploited if an attacker controls the command strings.
bsdkrun exec allows for running arbitrary commands inside a running guest.
bsdkrun flavor add --provision <CMD> enables the execution of multiple provisioning commands during flavor creation.
[EXTERNAL_DOWNLOADS]: The CLI tool is designed to fetch and execute external content from remote sources.
bsdkrun linux <IMAGE> downloads OCI images from registries such as Docker Hub or GitHub Container Registry.
bsdkrun fetch downloads FreeBSD and NetBSD arm64 images.
bsdkrun agent update downloads and installs a new guest agent from a remote release tag.
The --repo <URL> flag clones external Git repositories into the guest environment during boot.
[DATA_EXFILTRATION]: The skill mentions automated access to sensitive local files for configuration purposes.
bsdkrun ssh setup automatically reads and installs local public keys from ~/.ssh/id_*.pub. While these are public keys, the tool's access to the sensitive .ssh directory is a pattern associated with data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill documents an attack surface where an agent processing untrusted data could be manipulated.
Ingestion points: The tool ingests OCI images via bsdkrun linux and Git repositories via the --repo flag.
Boundary markers: There are no documented boundary markers or instructions to ignore embedded commands in the ingested data.
Capability inventory: The skill provides significant capabilities including arbitrary command execution (exec), network management (network), and persistent storage writes (volume).
Sanitization: No sanitization or validation of the external content is described before execution or interpolation.
[REMOTE_CODE_EXECUTION]: The combination of downloading remote artifacts (images, agents, repos) and executing them within the VM environment constitutes a remote code execution vector if the sources are untrusted.

bsdkrun-cli