The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill is instructed to locate and collect highly sensitive information including SSH keys, GitHub deploy keys, and authentication tokens associated with the machine being retired. While it aims to revoke or remove these, the initial collection exposes these credentials to the agent context.
[INDIRECT_PROMPT_INJECTION]: The agent processes a wide range of potentially untrusted data during its 'Take stock' phase, which can be exploited if those files contain malicious instructions.
Ingestion points: Reads ~/.config/agents/source.md, workstation repositories, all files in the home folder, git repositories (including uncommitted files and stashes), application data in ~/.local/share, proxy configurations, and cron jobs.
Boundary markers: None; the instructions do not specify the use of delimiters or ignore-instructions warnings when reading these files.
Capability inventory: The skill can execute shell commands (tailscale, ssh-keygen, gh, herdr), read and write to local files (Step 7), and perform network operations via integrated tools.
Sanitization: No sanitization or validation of the ingested file content is mentioned.
[DATA_EXFILTRATION]: The skill accesses sensitive system configuration files including ~/.ssh/config and known_hosts to identify and remove host references, which exposes the user's network trust relationships to the agent.
[COMMAND_EXECUTION]: The skill relies on multiple command-line utilities to perform its tasks, including tailscale for network logout, ssh-keygen for host key management, gh for GitHub account interaction, and herdr for machine management.

retire-machine