The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses the subprocess module to execute system utilities and third-party CLI tools on the local machine.
cli.py and multiple drivers (adb.py, broadlink.py, ssh.py) use subprocess.run to call adb, ssh, nc, ping, arp, and openssl.
Shell scripts in the scripts/ directory perform network probing and system configuration tasks.
references/troubleshooting.md contains instructions for using dd to create swap files on a router, which is a legitimate administrative task but involves potentially destructive system commands.
[REMOTE_CODE_EXECUTION]: The skill provides mechanisms to execute arbitrary or templated commands on remote network devices.
drivers/ssh.py and drivers/adb.py substitute user-provided parameters into command templates that are then executed on routers or Android devices.
scripts/run.sh allows execution of arbitrary commands on the router via SSH, though it implements a basic command allowlist and user confirmation prompt.
[CREDENTIALS_UNSAFE]: The skill handles authentication for local network devices and includes hardcoded credentials.
scripts/connect.sh contains a list of common default passwords (e.g., 'admin', 'password', 'root', '12345678') that it automatically attempts when connecting to a router via SSH.
drivers/ssap.py (LG TV control) and scripts/connect.sh store sensitive pairing keys and router credentials in ~/.lan-control/ using chmod 0600 to restrict access.
[INDIRECT_PROMPT_INJECTION]: The skill's discovery logic represents a surface for indirect injection as it ingests untrusted data from the local network.
Ingestion points: scripts/devices.sh reads DHCP lease hostnames, and scripts/discover.sh captures HTTP titles, SSH banners, and mDNS service data.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are used when processing this network metadata.
Capability inventory: The skill possesses extensive local and remote command execution capabilities via subprocess and ssh.
Sanitization: Metadata is matched against device profiles using regex patterns in registry.py but is not otherwise sanitized before being used to identify and interact with devices.
[DYNAMIC_EXECUTION]: The skill uses dynamic loading and conditional execution patterns to maintain broad compatibility.
drivers/broadlink.py and drivers/ssap.py use lazy imports and conditional logic to switch between Python libraries (like cryptography or yaml) and system CLI tool fallbacks.
registry.py utilizes __import__('sys') to access stderr within an exception handler.
[EXTERNAL_DOWNLOADS]: The drivers/ssap.py driver includes functionality to download image files (specifically TV screenshots) from a dynamically determined IP address on the local network using socket and ssl.

router-control