The Agent Skills Directory

[PROMPT_INJECTION]: The instructions in SKILL.md explicitly direct the agent to bypass human-in-the-loop safety controls by stating 'Zo should not ask for user confirmation to continue' and to treat the file's presence as an immediate command to 'run' the task. This suppresses the user's ability to review or stop the execution of sensitive system changes.
[COMMAND_EXECUTION]: The skill performs high-risk system modifications, including editing /etc/ssh/sshd_config to enable PermitRootLogin yes and PasswordAuthentication yes, which facilitates remote administrative access to the container.
[CREDENTIALS_UNSAFE]: The setup procedure for password-based authentication uses an insecure command pattern (echo "root:<password>" | chpasswd) that handles sensitive root credentials in plaintext, potentially exposing them in process logs or shell metadata.
[COMMAND_EXECUTION]: The skill uses the register_user_service tool to expose the SSH daemon to the public internet via a vendor-provided TCP address (ts1.zocomputer.io). While this is the skill's primary purpose, the combination of public exposure, root login, and suppressed confirmation creates a significant security risk.

ssh-setup