The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill performs remote command execution by SSHing into internal servers (10.0.10.15 and 10.0.20.100) as the root user to configure storage and verify mounts. This allows the agent to execute arbitrary commands with full system privileges on the target hosts.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests configuration and documentation from external, untrusted GitHub repositories. An attacker could place malicious instructions in a repository's README or documentation files to influence the agent's actions during the deployment workflow.
Ingestion points: README files, docker-compose.yml, and documentation from user-provided GitHub repositories (SKILL.md, Section 1).
Boundary markers: None identified. The instructions do not define delimiters or warnings for the agent to ignore instructions embedded in external content.
Capability inventory: High-privilege actions including SSH root access, infrastructure deployment via Terraform (terraform apply), and cluster management via kubectl (SKILL.md, Sections 3, 7, and 8).
Sanitization: None. The agent extracts environment variables and deployment parameters directly from external sources without validation.
[COMMAND_EXECUTION]: The skill uses chmod 777 to set world-writable permissions on persistent storage directories (SKILL.md, Section 3). This is a security risk that allows any user or process on the system to read, write, or delete data in those shared directories.

setup-project