The Agent Skills Directory

[COMMAND_EXECUTION]: The exec:// protocol documented in references/route.md allows the application to start an arbitrary executable file (script or ELF binary) from any path and proxy traffic to it. This provides a direct mechanism for executing arbitrary code within the environment.
[COMMAND_EXECUTION]: The setup_script field, as shown in SKILL.md and references/advanced-routes.md, allows for the execution of shell commands (e.g., using cat to overwrite system configurations) during the initialization of the app-proxy service and other containers.
[PRIVILEGE_ESCALATION]: The application.ingress feature for TCP/UDP forwarding, detailed in references/l4forward.md, allows applications to bypass the platform's standard authentication and security layers. Specifically, the yes_i_want_80_443:true flag enables direct handling of port 80/443 traffic, which disables system-provided account authentication, automatic application awakening, and managed HTTPS certificate configuration.
[CREDENTIALS_UNSAFE]: The documentation for app-proxy in references/advanced-routes.md provides examples of hardcoding credentials in environment variables using the BASIC_AUTH_HEADER field (e.g., Basic dXNlcjpwYXNzd29yZA==), which encourages the storage of sensitive authentication data in plain-text manifests.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent on how to build complex manifests based on user requirements, creating a surface for indirect injection where malicious user input could be interpolated into executable fields.
Ingestion points: User-provided parameters for subdomain, routes, and setup_script content used to generate lzc-manifest.yml.
Boundary markers: Absent; the instructions do not specify any delimiters or warnings to ignore instructions embedded in the user-provided data.
Capability inventory: Binary execution via exec://, shell command execution via setup_script, and authentication bypass via ingress port exposure.
Sanitization: Absent; there are no instructions for the agent to sanitize, escape, or validate user-provided strings before inserting them into executable configuration fields.

lazycat-advanced-routing