The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts in references/automation-toil.md and references/incident-chaos.md that use subprocess.run to execute system commands.
The scripts call powerful system utilities including kubectl, systemctl, iptables, tc, and find.
These operations typically require high privileges (root or cluster-admin) and modify critical system states, such as service status and network configurations.
[COMMAND_EXECUTION]: The AutomatedRunbook implementation in references/automation-toil.md executes shell commands with shell=True. This is a known security risk that can lead to command injection if any part of the command string is derived from untrusted user input or external data.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is designed to process external data sources like logs and incident reports.
Ingestion points: The agent reads logs and reports as specified in SKILL.md and references/incident-chaos.md.
Boundary markers: There are no instructions or delimiters defined to help the agent distinguish between its instructions and potentially malicious content within the logs.
Capability inventory: The skill provides direct access to shell execution and system management tools.
Sanitization: No validation or sanitization is performed on the data before it is used to drive automation steps.
[REMOTE_CODE_EXECUTION]: The script references/monitoring-alerting.md attempts to import a non-standard Python package grafana_dashboard. This package is not a well-known library in the official Python registry (PyPI), and the reference lacks version pinning, creating a risk of executing unverified code from an unknown source.

sre-engineer